[Bug c/103816] New: ICE: in vect_build_slp_tree_2, at tree-vect-slp.c:1748

[Bug c/103816] New: ICE: in vect_build_slp_tree_2, at tree-vect-slp.c:1748

[k.even-mendoza at imperial dot ac.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103816

            Bug ID: 103816
           Summary: ICE: in vect_build_slp_tree_2, at tree-vect-slp.c:1748
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: k.even-mendoza at imperial dot ac.uk
  Target Milestone: ---

This program crashed with GCC-12 with -O2 and -O3:

typedef enum { e } f;
struct {
  f __attribute__((mode(__byte__))) a;
  f __attribute__((mode(__byte__))) b;
  f __attribute__((mode(__byte__))) c;
  f __attribute__((mode(__byte__))) d
} g[];
void main() { g[0].b = (g[0].b & g[4].b) * g[2305843009213693952].c; }


This code works fine with GCC-11. I tried several versions of GCC-12: 20211023,
20211118, and 20211216 on Ubuntu-18.

The trace looks like this:
===
fuzzer-file-54092.c:7:1: warning: no semicolon at end of struct or union
    7 | } g[];
      | ^
fuzzer-file-54092.c:7:3: warning: array ‘g’ assumed to have one element
    7 | } g[];
      |   ^
during GIMPLE pass: slp
fuzzer-file-54092.c: In function ‘main’:
fuzzer-file-54092.c:8:6: internal compiler error: in vect_build_slp_tree_2, at
tree-vect-slp.c:1748
    8 | void main() { g[0].b = (g[0].b & g[4].b) * g[2305843009213693952].c; }
      |      ^~~~
0x7d2c1c vect_build_slp_tree_2
        .././../gcc-source/gcc/tree-vect-slp.c:1748
0x119b89d vect_build_slp_tree
        .././../gcc-source/gcc/tree-vect-slp.c:1549
0x119fe30 vect_build_slp_instance
        .././../gcc-source/gcc/tree-vect-slp.c:3025
0x11a5966 vect_analyze_slp(vec_info*, unsigned int)
        .././../gcc-source/gcc/tree-vect-slp.c:3388
0x11aa0ea vect_slp_analyze_bb_1
        .././../gcc-source/gcc/tree-vect-slp.c:5762
0x11aa0ea vect_slp_region
        .././../gcc-source/gcc/tree-vect-slp.c:5864
0x11aa0ea vect_slp_bbs
        .././../gcc-source/gcc/tree-vect-slp.c:6056
0x11ac131 vect_slp_function(function*)
        .././../gcc-source/gcc/tree-vect-slp.c:6144
0x11b36e2 execute
        .././../gcc-source/gcc/tree-vectorizer.c:1503
Please submit a full bug report,

[Bug tree-optimization/103816] [12 Regression] ICE: in vect_build_slp_tree_2, at tree-vect-slp.c:1748 since r12-1551-g3dfa4fe9f1a089b2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103816

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
      Known to work|                            |11.2.0
          Component|c                           |tree-optimization
   Target Milestone|---                         |12.0
      Known to fail|                            |12.0
   Last reconfirmed|                            |2021-12-23
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
     Ever confirmed|0                           |1
            Summary|ICE: in                     |[12 Regression] ICE: in
                   |vect_build_slp_tree_2, at   |vect_build_slp_tree_2, at
                   |tree-vect-slp.c:1748        |tree-vect-slp.c:1748 since
                   |                            |r12-1551-g3dfa4fe9f1a089b2

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-1551-g3dfa4fe9f1a089b2.

[Bug tree-optimization/103816] [12 Regression] ICE: in vect_build_slp_tree_2, at tree-vect-slp.c:1748 since r12-1551-g3dfa4fe9f1a089b2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103816

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.

[Bug tree-optimization/103816] [12 Regression] ICE: in vect_build_slp_tree_2, at tree-vect-slp.c:1748 since r12-1551-g3dfa4fe9f1a089b2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103816

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Note the access to 'g' makes it larger than half of the address space which
makes the program ill-formed.

[Bug tree-optimization/103816] [12 Regression] ICE: in vect_build_slp_tree_2, at tree-vect-slp.c:1748 since r12-1551-g3dfa4fe9f1a089b2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103816

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:1021b72bf6542f3c08e5404b65063216ee1b06f7

commit r12-6222-g1021b72bf6542f3c08e5404b65063216ee1b06f7
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Jan 5 10:14:52 2022 +0100

    tree-optimization/103816 - detect offset overflow in SLP group analysis

    This makes sure to detect overflow when computing DR_GROUP_GAP
    and DR_GROUP_SIZE more thoroughly so artificial testcases like the
    added one are not fooling the existing check.

    2022-01-05  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/103816
            * tree-vect-data-refs.c (vect_analyze_group_access_1): Also
            check DR_GROUP_GAP compute for overflow and representability.

            * gcc.dg/torture/pr103816.c: New testcase.

[Bug tree-optimization/103816] [12 Regression] ICE: in vect_build_slp_tree_2, at tree-vect-slp.c:1748 since r12-1551-g3dfa4fe9f1a089b2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103816

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.