[Bug c/105148] New: [11/12 Regression] ICE in verify_use, at tree-ssa.cc:881

[Bug c/105148] New: [11/12 Regression] ICE in verify_use, at tree-ssa.cc:881

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105148

            Bug ID: 105148
           Summary: [11/12 Regression] ICE in verify_use, at
                    tree-ssa.cc:881
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gscfq@t-online.de
  Target Milestone: ---

Started between 20201122 and 20201129, at -O2+ :


$ cat z1.c
extern int h (void);
extern int a[7][256];
static int f (int a[7][256], int n)
{
  for (int i = 0; i < n; i++) {
    int v = h(), a[1][i];
    a[n][i] = 0;
  }
}
int g (void)
{
  return f (a, 5);
}


$ gcc-12-20220403 -c z1.c -O1
$
$ gcc-12-20220403 -c z1.c -O2
during GIMPLE pass: ivopts
z1.c: In function 'g':
z1.c:10:5: internal compiler error: Segmentation fault
   10 | int g (void)
      |     ^
0xe0a17f crash_signal
        ../../gcc/toplev.cc:322
0x109ebab verify_use
        ../../gcc/tree-ssa.cc:881
0x10a3942 verify_ssa(bool, bool)
        ../../gcc/tree-ssa.cc:1164
0xd01ea7 execute_function_todo
        ../../gcc/passes.cc:2092
0xd027f2 execute_todo
        ../../gcc/passes.cc:2139

[Bug c/105148] [11/12 Regression] ICE in verify_use, at tree-ssa.cc:881

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105148

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-04-04
             Status|UNCONFIRMED                 |ASSIGNED
           Priority|P3                          |P2
     Ever confirmed|0                           |1
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
   Target Milestone|---                         |11.3
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with my r11-5444-ga3ebc13492ff238873f2c6a7a3e51abefec1d052
I'll have a look.

[Bug c/105148] [11/12 Regression] ICE in verify_use, at tree-ssa.cc:881

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105148

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Reduced testcase:
extern void foo (void);

static inline int
bar (int n)
{
  for (int i = 0; i < n; i++)
    {
      foo ();
      int y[1][i];
      y[n][i] = 0;
    }
}

int
baz (void)
{
  return bar (5);
}

[Bug c/105148] [11/12 Regression] ICE in verify_use, at tree-ssa.cc:881

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105148

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|jakub at gcc dot gnu.org           |unassigned at gcc dot gnu.org
             Status|ASSIGNED                    |NEW

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
This looks like an ivopts bug and I'm unfortunately not familiar enough with
that pass.
Before ivopts we have:
  <bb 3> [local count: 8687547547]:
  # i_2 = PHI <i_10(5), 0(2)>
  # ivtmp_19 = PHI <ivtmp_11(5), 5(2)>
  saved_stack.2_4 = __builtin_stack_save ();
  foo ();
  _6 = (sizetype) i_2;
  _7 = _6 * 4;
  y.1_8 = __builtin_alloca_with_align (_7, 32);
  MEM <int[1][0:D.2027]> [(int[1][0:D.1996] *)y.1_8][5]{lb: 0 sz: _6 * 4}[i_2]
= 0;
  __builtin_stack_restore (saved_stack.2_4);
  i_10 = i_2 + 1;
  ivtmp_11 = ivtmp_19 - 1;
  if (ivtmp_11 != 0)
    goto <bb 5>; [89.00%]
  else
    goto <bb 4>; [11.00%]

  <bb 5> [local count: 7731917322]:
  goto <bb 3>; [100.00%]
loop and ivopts decides to create a new unsigned long ivtmp.9 IV going from
0 with step 1.  But it doesn't properly adjust the ARRAY_REF with sz:, so it
keeps referencing a freed SSA_NAME _6:
  <bb 3> [local count: 8687547547]:
  # ivtmp.9_5 = PHI <ivtmp.9_9(5), 0(2)>
  _20 = (unsigned int) ivtmp.9_5;
  i_2 = (int) _20;
  saved_stack.2_4 = __builtin_stack_save ();
  foo ();
  _3 = ivtmp.9_5 * 4;
  _7 = _3;
  y.1_8 = __builtin_alloca_with_align (_7, 32);
  MEM <int[1][0:D.2027]> [(int[1][0:D.1996] *)y.1_8][5]{lb: 0 sz: <<< error
>>>}[i_2] = 0;
  __builtin_stack_restore (saved_stack.2_4);
  ivtmp.9_9 = ivtmp.9_5 + 1;
  if (ivtmp.9_9 != 5)
    goto <bb 5>; [89.00%]
  else
    goto <bb 4>; [11.00%]

  <bb 5> [local count: 7731917322]:
  goto <bb 3>; [100.00%]
I believe it should use ivtmp.9_5 (printed as ivtmp.9_5 * 4).

[Bug c/105148] [11/12 Regression] ICE in verify_use, at tree-ssa.cc:881

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105148

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
-  MEM <int[1][0:D.2027]> [(int[1][0:D.1996] *)y.1_8][5]{lb: 0 sz: _6 * 4}[i_2]
= 0;
+  MEM <int[1][0:D.2027]> [(int[1][0:D.1996] *)y.1_8][5]{lb: 0 sz: <<< error
>>>}[i_2] = 0;

find_interesting_uses_op fails to consider _6 * 4, in fact idx_record_use
does

  if (TREE_CODE (base) == ARRAY_REF || TREE_CODE (base) == ARRAY_RANGE_REF)
    {
      find_interesting_uses_op (data, array_ref_element_size (base));
      find_interesting_uses_op (data, array_ref_low_bound (base));
    }

but it should probably pass down the raw TREE_OPERANDs, not the scaled
array_ref_element_size ().

I have a patch:

diff --git a/gcc/tree-ssa-loop-ivopts.cc b/gcc/tree-ssa-loop-ivopts.cc
index b0305c494cd..81b536f9304 100644
--- a/gcc/tree-ssa-loop-ivopts.cc
+++ b/gcc/tree-ssa-loop-ivopts.cc
@@ -2124,8 +2124,10 @@ idx_record_use (tree base, tree *idx,
   find_interesting_uses_op (data, *idx);
   if (TREE_CODE (base) == ARRAY_REF || TREE_CODE (base) == ARRAY_RANGE_REF)
     {
-      find_interesting_uses_op (data, array_ref_element_size (base));
-      find_interesting_uses_op (data, array_ref_low_bound (base));
+      if (TREE_OPERAND (base, 2))
+       find_interesting_uses_op (data, TREE_OPERAND (base, 2));
+      if (TREE_OPERAND (base, 3))
+       find_interesting_uses_op (data, TREE_OPERAND (base, 3));
     }
   return true;
 }

[Bug c/105148] [11/12 Regression] ICE in verify_use, at tree-ssa.cc:881

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105148

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

[Bug c/105148] [11/12 Regression] ICE in verify_use, at tree-ssa.cc:881

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105148

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:86242eb1bd03eba82d8e22b01b16925d43bcc539

commit r12-8014-g86242eb1bd03eba82d8e22b01b16925d43bcc539
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Apr 5 16:06:10 2022 +0200

    tree-optimization/105148 - fix IVOPTs recording uses

    The following fixes recording uses in ARRAY_REFs with non-constant
    element size or low bound.

    2022-04-05  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/105148
            * tree-ssa-loop-ivopts.cc (idx_record_use): Walk raw operands
            2 and 3 of ARRAY_REFs.

            * gcc.dg/torture/pr105148.c: New testcase.

[Bug c/105148] [11 Regression] ICE in verify_use, at tree-ssa.cc:881

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105148

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.3                        |11.4

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 11.3 is being released, retargeting bugs to GCC 11.4.

[Bug c/105148] [11 Regression] ICE in verify_use, at tree-ssa.cc:881

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105148

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:64b3a86d33e08072ea78f2a87c8a275bd15f07cb

commit r11-10014-g64b3a86d33e08072ea78f2a87c8a275bd15f07cb
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Apr 5 16:06:10 2022 +0200

    tree-optimization/105148 - fix IVOPTs recording uses

    The following fixes recording uses in ARRAY_REFs with non-constant
    element size or low bound.

    2022-04-05  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/105148
            * tree-ssa-loop-ivopts.c (idx_record_use): Walk raw operands
            2 and 3 of ARRAY_REFs.

            * gcc.dg/torture/pr105148.c: New testcase.

    (cherry picked from commit 86242eb1bd03eba82d8e22b01b16925d43bcc539)

[Bug c/105148] [11 Regression] ICE in verify_use, at tree-ssa.cc:881

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105148

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED
      Known to fail|11.2.1                      |11.3.0
      Known to work|                            |11.3.1

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.