[Bug tree-optimization/103851] New: ICE in gimple_range_global at gcc/value-query.cc:424 since r12-3433-ga25e0b5e6ac8a77a

[Bug tree-optimization/103851] New: ICE in gimple_range_global at gcc/value-query.cc:424 since r12-3433-ga25e0b5e6ac8a77a

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103851

            Bug ID: 103851
           Summary: ICE in gimple_range_global at gcc/value-query.cc:424
                    since r12-3433-ga25e0b5e6ac8a77a
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: qing.zhao at oracle dot com, rguenth at gcc dot gnu.org
  Target Milestone: ---

The following ICEs:

$ cat inkscape.ii
struct pointer_traits {
  template <typename _Up> using rebind = _Up *;
};
template <typename, typename _Tp>
using __ptr_rebind = pointer_traits::rebind<_Tp>;
struct _Deque_iterator {
  __ptr_rebind<int, int> _M_cur;
};
struct _Deque_base {
  long _M_map_size;
  _Deque_iterator _M_start;
  _Deque_iterator _M_finish;
};
enum { Y };
namespace {
template <typename, int, int BPP> void morphologicalFilter1D() {
#pragma omp parallel
  _Deque_base vals[BPP];
}
} // namespace
void FilterMorphologyrender_cairo() { morphologicalFilter1D<int, Y, 4>; }

$ g++ inkscape.ii -fopenmp -c -ftrivial-auto-var-init=pattern
during GIMPLE pass: walloca
inkscape.ii: In function ‘void {anonymous}::morphologicalFilter1D() [with
<template-parameter-1-1> = int; int <anonymous> = 0; int BPP = 4]’:
inkscape.ii:18:15: internal compiler error: Segmentation fault
   18 |   _Deque_base vals[BPP];
      |               ^~~~
0x123be8a crash_signal
        /home/marxin/Programming/gcc/gcc/toplev.c:322
0x7ffff787d42f ???
       
/usr/src/debug/glibc-2.34-4.1.x86_64/signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x153b0f0 gimple_range_global(tree_node*)
        /home/marxin/Programming/gcc/gcc/value-query.cc:424
0x1f5d015 ranger_cache::get_global_range(irange&, tree_node*) const
        /home/marxin/Programming/gcc/gcc/gimple-range-cache.cc:933
0x1f5d015 ranger_cache::get_global_range(irange&, tree_node*) const
        /home/marxin/Programming/gcc/gcc/gimple-range-cache.cc:929
0x1f59c34 gimple_ranger::export_global_ranges()
        /home/marxin/Programming/gcc/gcc/gimple-range.cc:453
0x1f98895 pass_walloca::execute(function*)
        /home/marxin/Programming/gcc/gcc/gimple-ssa-warn-alloca.c:381
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/103851] ICE in gimple_range_global at gcc/value-query.cc:424 since r12-3433-ga25e0b5e6ac8a77a

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103851

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Target Milestone|---                         |12.0
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-12-28

[Bug tree-optimization/103851] ICE in gimple_range_global with -ftrivial-auto-var-init=pattern since r12-3433-ga25e0b5e6ac8a77a

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103851

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |openmp

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The SSA_NAME does not have a definition any more but not released:
 <ssa_name 0x7ffff6e7d240
    type <pointer_type 0x7ffff6e81000
        type <record_type 0x7ffff6e76000 _Deque_base sizes-gimplified cxx-odr-p
type_5 type_6 BLK
            size <integer_cst 0x7ffff6d02408 constant 192>
            unit-size <integer_cst 0x7ffff6d023d8 constant 24>
            align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff6e76000 fields <function_decl 0x7ffff6e84300 __dt > context
<translation_unit_decl 0x7ffff6cee168 t45.cc>
            full-name "struct _Deque_base"
            X() X(constX&) this=(X&) n_parents=0 use_template=0
interface-unknown
            pointer_to_this <pointer_type 0x7ffff6e81000> reference_to_this
<reference_type 0x7ffff6e81540> chain <type_decl 0x7ffff6e751c8 _Deque_base>>
        unsigned DI
        size <integer_cst 0x7ffff6ce0f48 constant 64>
        unit-size <integer_cst 0x7ffff6ce0f60 constant 8>
        align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff6e81000>

    def_stmt
    version:1>

When openmp outlines the basic-block, it must not have released them:
  #pragma omp parallel [child fn:
_ZN12_GLOBAL__N_121morphologicalFilter1DIiLi0ELi4EEEvv._omp_fn.0 (???)]

  <bb 3> :
  vals = .DEFERRED_INIT (96, 1, 0);
  D.2608 = &vals + 0;
  _1 = D.2608 + 96;
  goto <bb 5>; [INV]

  <bb 4> :
  D.2608 = D.2608 + 24;

  <bb 5> :
  if (D.2608 != _1)
    goto <bb 4>; [INV]
  else
    goto <bb 6>; [INV]

  <bb 6> :
  vals = {CLOBBER};
  #pragma omp return


I don't see anything exactly related to ftrivial-auto-var-init really except it
adding the loop around vals.

[Bug tree-optimization/103851] ICE in gimple_range_global with -ftrivial-auto-var-init=pattern since r12-3433-ga25e0b5e6ac8a77a

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103851

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Here is an even more reduced testcase:
struct _Deque_base {
  long _M_map_size;
  int *_M_start;
  int *_M_finish;
};
void morphologicalFilter1D() {
#pragma omp parallel
  {
  struct _Deque_base vals[4];
  }
}

---- CUT ---
The above testcase can be used with either the C or C++ front-ends now too.
I would say the bug is in value-query.cc really for not checking the defining
statement is non-null when it is looping through all of the ssa names.

[Bug tree-optimization/103851] ICE in gimple_range_global with -ftrivial-auto-var-init=pattern since r12-3433-ga25e0b5e6ac8a77a

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103851

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |amacleod at redhat dot com
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Indeed what gimple_ranger::export_global_ranges does is a bit iffy but we
shouldn't have SSA names not in the free list with a NULL def stmts.

The SSA name in question is allocated here:

 #2  0x000000000135e968 in clear_padding_type (buf=0x7fffffffaeb0, 
    type=<array_type 0x7ffff66d9738>, sz=96, for_auto_init=true)
    at /home/rguenther/src/gcc3/gcc/gimple-fold.c:4774
4774              tree end = make_ssa_name (TREE_TYPE (buf->base));

it's defining stmt is cleared via move_sese_region_to_fn doing in
replace_ssa_name

      /* Now that we've used the def stmt to define new_name, make sure it
         doesn't define name anymore.  */
      SSA_NAME_DEF_STMT (name) = NULL;

but we expect those SSA names to be released later but that only happens when
gimple_in_ssa_p:

  if (gimple_in_ssa_p (cfun))
    { 
      /* We need to release ssa-names in a defined order, so first find them,
         and then iterate in ascending version order.  */
      bitmap release_names = BITMAP_ALLOC (NULL);
      vars_map.traverse<void *, gather_ssa_name_hash_map_from> (release_names);
      bitmap_iterator bi;
      unsigned i;
      EXECUTE_IF_SET_IN_BITMAP (release_names, 0, i, bi)
        release_ssa_name (ssa_name (i));

[Bug tree-optimization/103851] ICE in gimple_range_global with -ftrivial-auto-var-init=pattern since r12-3433-ga25e0b5e6ac8a77a

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103851

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:4911609fbe47d3e4d2765cd67031a7e0ee9f5af0

commit r12-6189-g4911609fbe47d3e4d2765cd67031a7e0ee9f5af0
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Jan 3 12:55:45 2022 +0100

    middle-end/103851 - ensure SSA names are released during OMP lowering

    This makes sure to release moved & remapped SSA names during OMP
    outlining which happens before going into SSA but with SSA names
    created by gimplification around.

    2022-01-03  Richard Biener  <rguenther@suse.de>

            PR middle-end/103851
            * tree-cfg.c (move_sese_region_to_fn): Always release SSA names.

            * g++.dg/gomp/pr103851.C: New testcase.

[Bug tree-optimization/103851] ICE in gimple_range_global with -ftrivial-auto-var-init=pattern since r12-3433-ga25e0b5e6ac8a77a

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103851

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.  I guess fine for GCC 11 as the pre-SSA warning pass likely isn't ranger
enabled there.