[Bug tree-optimization/104528] New: [12 Regression] ICE: Segmentation fault (in gimple_bb)

[Bug tree-optimization/104528] New: [12 Regression] ICE: Segmentation fault (in gimple_bb)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104528

            Bug ID: 104528
           Summary: [12 Regression] ICE: Segmentation fault (in gimple_bb)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

Created attachment 52435
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52435&action=edit
Testcase

gfortran 12.0.1 20220213 snapshot (g:58aeb75d4097010ad9bb72b964265b18ab284f93)
ICEs when compiling the attached testcase w/ -O2 -fpeel-loops
-ftree-loop-vectorize -fno-tree-scev-cprop --param iv-max-considered-uses=2:

% gfortran-12.0.1 -O2 -fpeel-loops -ftree-loop-vectorize -fno-tree-scev-cprop
--param iv-max-considered-uses=2 -c atm8wqik.f
during GIMPLE pass: ivopts
atm8wqik.f:1:37:

    1 |       REAL               FUNCTION FOO(M, N, A, W)
      |                                     ^
internal compiler error: Segmentation fault
0xf5175f crash_signal
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/toplev.cc:322
0x1e3964d gimple_bb
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/gimple.h:1871
0x1e3964d loop_containing_stmt
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-ssa-loop.h:76
0x1e3964d chrec_contains_symbols_defined_in_loop
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-chrec.cc:1009
0x1e39714 chrec_contains_symbols_defined_in_loop
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-chrec.cc:1026
0x1e397f4 chrec_contains_symbols_defined_in_loop(tree_node const*, unsigned
int)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-chrec.cc:1039
0x10390e9 compute_overall_effect_of_inner_loop(loop*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:473
0x103963e follow_ssa_edge_inner_loop_phi
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1114
0x103963e follow_ssa_edge_expr
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1183
0x10397e0 follow_ssa_edge_in_condition_phi_branch
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1011
0x10397e0 follow_ssa_edge_in_condition_phi
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1037
0x10397e0 follow_ssa_edge_expr
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1165
0x10397e0 follow_ssa_edge_in_condition_phi_branch
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1011
0x10397e0 follow_ssa_edge_in_condition_phi
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1037
0x10397e0 follow_ssa_edge_expr
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1165
0x10397e0 follow_ssa_edge_in_condition_phi_branch
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1011
0x10397e0 follow_ssa_edge_in_condition_phi
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1037
0x10397e0 follow_ssa_edge_expr
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1165
0x10397e0 follow_ssa_edge_in_condition_phi_branch
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1011
0x10397e0 follow_ssa_edge_in_condition_phi
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/tree-scalar-evolution.cc:1037

[Bug tree-optimization/104528] [12 Regression] ICE: Segmentation fault (in gimple_bb)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104528

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Target Milestone|---                         |12.0
             Status|UNCONFIRMED                 |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
   Last reconfirmed|                            |2022-02-14

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Usually a sign of using a stale SCEV cache entry.

[Bug tree-optimization/104528] [12 Regression] ICE: Segmentation fault (in gimple_bb)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104528

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
At the start of IVOPTs we have

(gdb) p debug_tree (cfun->x_current_loops->larray->m_vecdata[4]->nb_iterations)
 <minus_expr 0x7ffff6348f28
    type <integer_type 0x7ffff670ce70 public unsigned SI
        size <integer_cst 0x7ffff6517e40 constant 32>
        unit-size <integer_cst 0x7ffff6517e58 constant 4>
        align:32 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff670ce70 precision:32 min <integer_cst 0x7ffff6321078 0> max <integer_cst
0x7ffff6321060 4294967295>>

    arg:0 <ssa_name 0x7ffff631e240 type <error_mark 0x7ffff6517be8>
        nothrow
        def_stmt 
        version:36 in-free-list>
    arg:1 <nop_expr 0x7ffff6349400 type <integer_type 0x7ffff670ce70>

        arg:0 <ssa_name 0x7ffff63345a0 type <integer_type 0x7ffff652f5e8
integer(kind=4)>
            visited
            def_stmt pretmp_90 = ii;
            version:90>>>
$12 = void

so that mentions a released SSA name.  It's released during DSE which
fails to reset niter info since we now prune dead SSA names there.

[Bug tree-optimization/104528] [12 Regression] ICE: Segmentation fault (in gimple_bb)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104528

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:0a1a3afb5fb36e2d10ad92bf788e16d837451571

commit r12-7228-g0a1a3afb5fb36e2d10ad92bf788e16d837451571
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Feb 14 13:37:54 2022 +0100

    tree-optimization/104528 - free niter estimates after DSE

    When DSE removes a trivially dead def we have to reset niter information
    on loops since that might refer to it.  The patch also adds verification
    to make sure this does not happen.

    2022-02-14  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/104528
            * tree-ssa.h (find_released_ssa_name): Declare.
            * tree-ssa.cc (find_released_ssa_name): Export.
            * cfgloop.cc (verify_loop_structure): Look for released
            SSA names in loops nb_iterations.
            * tree-ssa-dse.cc (pass_dse::execute): Release number of iteration
            estimates.

            * gfortran.dg/pr104528.f: New testcase.

[Bug tree-optimization/104528] [12 Regression] ICE: Segmentation fault (in gimple_bb)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104528

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.