[Bug tree-optimization/106182] New: [13 Regression] ICE in check_loop_closed_ssa_def, at tree-ssa-loop-manip.cc:717 since r13-1450-gd2a898666609452e

[Bug tree-optimization/106182] New: [13 Regression] ICE in check_loop_closed_ssa_def, at tree-ssa-loop-manip.cc:717 since r13-1450-gd2a898666609452e

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106182

            Bug ID: 106182
           Summary: [13 Regression] ICE in check_loop_closed_ssa_def, at
                    tree-ssa-loop-manip.cc:717 since
                    r13-1450-gd2a898666609452e
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: rguenth at gcc dot gnu.org
  Target Milestone: ---

The following ICEs:

$ cat func.ii
short var_32;
int test_var_0;
unsigned char test_var_6;
char test_var_13;
void test(int var_2) {
  for (;;)
    for (short i_7; i_7 < test_var_13; i_7 += 1)
      for (; test_var_0;) {
        for (; var_2;)
          var_32 = 0;
        for (char i_19; i_19 < test_var_6 + 135; i_19 += 200)
          ;
      }
}

$ g++ func.ii -c -O3
during GIMPLE pass: unswitch
func.ii: In function ‘void test(int)’:
func.ii:5:6: internal compiler error: in check_loop_closed_ssa_def, at
tree-ssa-loop-manip.cc:717
    5 | void test(int var_2) {
      |      ^~~~
0x8c2643 check_loop_closed_ssa_def
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-manip.cc:717
0x13edebc check_loop_closed_ssa_bb
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-manip.cc:731
0x13ef12e verify_loop_closed_ssa(bool, loop*)
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-manip.cc:767
0x13ef12e verify_loop_closed_ssa(bool, loop*)
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-manip.cc:751
0x1184127 execute_function_todo
        /home/marxin/Programming/gcc/gcc/passes.cc:2109
0x118452a execute_todo
        /home/marxin/Programming/gcc/gcc/passes.cc:2145
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/106182] [13 Regression] ICE in check_loop_closed_ssa_def, at tree-ssa-loop-manip.cc:717 since r13-1450-gd2a898666609452e

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106182

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Target Milestone|---                         |13.0
   Last reconfirmed|                            |2022-07-04
           Priority|P3                          |P1
     Ever confirmed|0                           |1

[Bug tree-optimization/106182] [13 Regression] ICE in check_loop_closed_ssa_def, at tree-ssa-loop-manip.cc:717 since r13-1450-gd2a898666609452e

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106182

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
This is a case where inner unswitched loops make one exit unconditional and one
never taken which means due to block loop ownership changes the outer loop
LC SSA is broken.  I don't see how this is prevented for the non-virtual
operand case or how just including the set of blocks with changed loop depth
can properly
compute LC SSA in CFG cleanup repair_loop_structures.

Specifically gimple_merge_blocks propagation of virtual PHIs "breaks" things
here but there's no other way (also inserting an assignment will still have
broken LC SSA for regular defs there, and meanwhile the a->loop_father !=
b->loop_father test works on not up-to-date loop info).

The following fixes the ICE.

diff --git a/gcc/tree-cfgcleanup.cc b/gcc/tree-cfgcleanup.cc
index a6d0bf2c40a..b3aa6f92440 100644
--- a/gcc/tree-cfgcleanup.cc
+++ b/gcc/tree-cfgcleanup.cc
@@ -1169,25 +1169,18 @@ cleanup_tree_cfg_noloop (unsigned ssa_update_flags)
 static void
 repair_loop_structures (void)
 {
-  bitmap changed_bbs;
-  unsigned n_new_loops;
-
   calculate_dominance_info (CDI_DOMINATORS);

   timevar_push (TV_REPAIR_LOOPS);
-  changed_bbs = BITMAP_ALLOC (NULL);
-  n_new_loops = fix_loop_structure (changed_bbs);
+  fix_loop_structure (NULL);

   /* This usually does nothing.  But sometimes parts of cfg that originally
      were inside a loop get out of it due to edge removal (since they
      become unreachable by back edges from latch).  Also a former
-     irreducible loop can become reducible - in this case force a full
-     rewrite into loop-closed SSA form.  */
+     irreducible loop can become reducible - in any case it's difficult
+     to restrict the rewrite to a set of affected blocks.  */
   if (loops_state_satisfies_p (LOOP_CLOSED_SSA))
-    rewrite_into_loop_closed_ssa (n_new_loops ? NULL : changed_bbs,
-                                 TODO_update_ssa);
-
-  BITMAP_FREE (changed_bbs);
+    rewrite_into_loop_closed_ssa (NULL, 0);

   checking_verify_loop_structure ();
   scev_reset ();

[Bug tree-optimization/106182] [13 Regression] ICE in check_loop_closed_ssa_def, at tree-ssa-loop-manip.cc:717 since r13-1450-gd2a898666609452e

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106182

Zhendong Su <zhendong.su at inf dot ethz.ch> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |zhendong.su at inf dot ethz.ch

--- Comment #2 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
*** Bug 106194 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/106182] [13 Regression] ICE in check_loop_closed_ssa_def, at tree-ssa-loop-manip.cc:717 since r13-1450-gd2a898666609452e

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106182

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:b55284f4a1235fccd8254f539ddc6b869580462b

commit r13-1467-gb55284f4a1235fccd8254f539ddc6b869580462b
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Jul 4 15:03:33 2022 +0200

    tree-optimization/106182 - LC SSA after CFG cleanup

    The testcase shows that when cleaning up the CFG we can end up
    with broken LC SSA (for virtual operands with the testcase).  The
    case here involves deleting a loop after which it is not enough
    to scan the blocks with changed loop depth for SSA uses that need
    to be rewritten.  So make fix_loop_sturcture return the sum of
    the number of new loops and the number of deleted loops.

            PR tree-optimization/106182
            * loop-init.cc (fix_loop_structure): Return the number
            of newly discovered plus the number of deleted loops.
            * tree-cfgcleanup.cc (repair_loop_structures): Adjust
            variable name.

            * gcc.dg/torture/pr106182.c: New testcase.

[Bug tree-optimization/106182] [13 Regression] ICE in check_loop_closed_ssa_def, at tree-ssa-loop-manip.cc:717 since r13-1450-gd2a898666609452e

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106182

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.