[Bug c++/106824] New: ice in set_nan, at value-range.cc:283

[Bug c++/106824] New: ice in set_nan, at value-range.cc:283

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

            Bug ID: 106824
           Summary: ice in set_nan, at  value-range.cc:283
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

Created attachment 53535
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53535&action=edit
gzipped C++ source code

The attached C++ code does this with recent gcc:

./../include/fst/shortest-path.h:191:6: internal compiler error: in set_nan, at 
value-range.cc:283
0x13fcb6b frange::set_nan(fp_prop::kind)
        ../../trunk.git/gcc/value-range.cc:283
0x204ccb1 foperator_not_equal::op1_range(frange&, tree_node*, irange const&,
fra
nge const&, relation_kind_t) const
        ../../trunk.git/gcc/range-op-float.cc:468
0x1f2298b gimple_range_calc_op1(vrange&, gimple const*, vrange const&, vrange
co
nst&)
        ../../trunk.git/gcc/gimple-range-gori.cc:0
0x1f25a6d gori_compute::compute_operand1_range(vrange&, gimple*, vrange const&, 
tree_node*, fur_source&)

Git range seems to be 152895769581468e..4fbe3e6aa74dae5c

Flags required are -march=bdver2 -O2. I have a reduction running.

[Bug c++/106824] ice in set_nan, at value-range.cc:283

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

--- Comment #1 from David Binderman <dcb314 at hotmail dot com> ---
It seems that flag -O2 can be reduced to -O1 -fexpensive-optimizations.

[Bug c++/106824] ice in set_nan, at value-range.cc:283

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

--- Comment #2 from David Binderman <dcb314 at hotmail dot com> ---
After more than 13 hours of reduction, the C++ code seems to be:

using int32 = int;
using int64 = long;
float NoWeight___trans_tmp_2;
int ShortestPath_distance;
struct FloatWeightTpl {
  FloatWeightTpl(float f) : value_(f) {}
  float Value() { return value_; }
  float value_;
};
template <class T> bool operator!=(FloatWeightTpl w1, T w2) {
  bool __trans_tmp_4;
  FloatWeightTpl __trans_tmp_5 = w1;
  __trans_tmp_4 = __trans_tmp_5.Value() == w2.Value();
  return !__trans_tmp_4;
}
template <class> struct TropicalWeightTpl : FloatWeightTpl {
  TropicalWeightTpl(float f) : FloatWeightTpl(f) {}
  static TropicalWeightTpl Zero();
  static TropicalWeightTpl NoWeight() {
    NoWeight___trans_tmp_2 = __builtin_nanf("");
    return NoWeight___trans_tmp_2;
  }
  bool Member() { return value_; }
};
template <class T>
constexpr TropicalWeightTpl<T> Plus(TropicalWeightTpl<T> w2) {
  return w2.Member() ? TropicalWeightTpl<T>::NoWeight() : w2;
}
float Times();
struct ArcTpl {
  using Weight = TropicalWeightTpl<float>;
};
template <class, class, class> struct ShortestPathOptions {
  using Weight = ArcTpl::Weight;
  ShortestPathOptions(int, int, int32, bool, bool, float, bool, Weight);
};
template <class Arc, class Queue, class ArcFilter>
void SingleShortestPath(ShortestPathOptions<Arc, Queue, ArcFilter>) {
  using Weight = typename Arc::Weight;
  auto f_distance = Weight::Zero();
  TropicalWeightTpl<float> __trans_tmp_1 = Times(), plus = Plus(__trans_tmp_1);
  if (f_distance != plus)
    f_distance = plus;
  if (f_distance.Member())
    for (;;)
      ;
}
template <class Arc, class Queue, class ArcFilter>
void ShortestPath(int, int *, int *,
                  ShortestPathOptions<Arc, Queue, ArcFilter> opts) {
  SingleShortestPath(opts);
}
struct ShortestDistanceOptions {
  float delta;
};
struct Trans_NS_script_ShortestPathOptions : ShortestDistanceOptions {
  int32 nshortest;
  bool unique;
  int64 state_threshold;
};
namespace internal {
template <class, class>
void ShortestPath(int ifst, int *ofst, int *distance,
                  Trans_NS_script_ShortestPathOptions opts) {
  using ArcFilter = int;
  ShortestPathOptions<ArcTpl, int, ArcFilter> sopts(
      0, ArcFilter(), opts.nshortest, opts.unique, false, opts.delta, 0,
      opts.state_threshold);
  ShortestPath(ifst, ofst, distance, sopts);
}
int ShortestPath_ifst;
int ShortestPath_ofst;
Trans_NS_script_ShortestPathOptions ShortestPath_opts;
void ShortestPath() {
  using StateId = int;
  ShortestPath<ArcTpl, StateId>(ShortestPath_ifst, &ShortestPath_ofst,
                                &ShortestPath_distance, ShortestPath_opts);
}
} // namespace internal

I will have a go at a bisect on git.

[Bug c++/106824] ice in set_nan, at value-range.cc:283

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

David Binderman <dcb314 at hotmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aldyh at gcc dot gnu.org

--- Comment #3 from David Binderman <dcb314 at hotmail dot com> ---
Git range seems to reduce to bfaa6807defb1887..4fbe3e6aa74dae5c, which is 5
commits.

Three of them are by Aldy, so adding them for their opinion.

[Bug c++/106824] ice in set_nan, at value-range.cc:283

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

--- Comment #4 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Yeah, that's all me.

I can't reproduce on x86-64, but there's been a couple patches in this area
over the weekend.  Could you double check again on an updated trunk?

[Bug c++/106824] ice in set_nan, at value-range.cc:283

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

--- Comment #5 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to Aldy Hernandez from comment #4)
> Could you double check again on an updated trunk?

Problem seems to have gone away on today's trunk.

[Bug c++/106824] ice in set_nan, at value-range.cc:283

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
fixed in trunk

[Bug c++/106824] ice in set_nan, at value-range.cc:283

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-09-05
             Status|RESOLVED                    |REOPENED
                 CC|                            |marxin at gcc dot gnu.org
     Ever confirmed|0                           |1
         Resolution|FIXED                       |---

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
Note the issue is still present with the current master.
Newly reduced test-case:

cat bug840.cc
using int32 = int;
int ShortestPath_distance;
struct FloatWeightTpl {
  FloatWeightTpl(float f) : value_(f) {}
  float Value() { return value_; }
  float value_;
};
template <class T> bool operator!=(FloatWeightTpl w1, T w2) {
  bool __trans_tmp_2;
  FloatWeightTpl __trans_tmp_3 = w1;
  __trans_tmp_2 = __trans_tmp_3.Value() == w2.Value();
  return __trans_tmp_2;
}
struct TropicalWeightTpl : FloatWeightTpl {
  TropicalWeightTpl(float f) : FloatWeightTpl(f) {}
  static TropicalWeightTpl Zero();
  static TropicalWeightTpl NoWeight() {
    float __trans_tmp_5 = __builtin_nanf("");
    return __trans_tmp_5;
  }
  bool Member() { return value_; }
};
TropicalWeightTpl Plus(TropicalWeightTpl w1, TropicalWeightTpl &w2) {
  return w1.Member() || w2.Member() ? TropicalWeightTpl::NoWeight()          :
w2.Value()               ? : w2;
}
TropicalWeightTpl Times();
struct ArcTpl {
  using Weight = TropicalWeightTpl;
};
template <class, class, class> struct ShortestPathOptions {
  ShortestPathOptions(int, int, int32, bool, bool);
};
template <class Arc, class Queue, class ArcFilter>
void SingleShortestPath(ShortestPathOptions<Arc, Queue, ArcFilter>) {
  using Weight = typename Arc::Weight;
  auto f_distance = Weight::Zero();
  while (!0) {
    TropicalWeightTpl __trans_tmp_1 = Times(),
                      plus = Plus(f_distance, __trans_tmp_1);
    if (f_distance != plus)
      f_distance = plus;
  }
}
template <class Arc, class Queue, class ArcFilter>
void ShortestPath(int, int *, int *,
                  ShortestPathOptions<Arc, Queue, ArcFilter> opts) {
  SingleShortestPath(opts);
}
struct ShortestDistanceOptions {
  float delta;
};
struct Trans_NS_script_ShortestPathOptions : ShortestDistanceOptions {
  int32 nshortest;
  bool unique;
};
namespace internal {
template <class, class>
void ShortestPath(int ifst, int *ofst, int *distance,
                  Trans_NS_script_ShortestPathOptions opts) {
  using ArcFilter = int;
  ShortestPathOptions<ArcTpl, int, ArcFilter> sopts(opts.nshortest,
opts.unique,
                                                    false, opts.delta, 0);
  ShortestPath(ifst, ofst, distance, sopts);
}
int ShortestPath_ifst;
int ShortestPath_ofst;
Trans_NS_script_ShortestPathOptions ShortestPath_opts;
void ShortestPath() {
  using StateId = int;
  ShortestPath<ArcTpl, StateId>(ShortestPath_ifst, &ShortestPath_ofst,
                                &ShortestPath_distance, ShortestPath_opts);
}
} // namespace internal

[Bug c++/106824] [13 Regression] ICE in set_nan, at value-range.cc:283 since r13-2266-g8bb1df032cc080b7

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|ice in set_nan, at          |[13 Regression] ICE in
                   |value-range.cc:283          |set_nan, at
                   |                            |value-range.cc:283 since
                   |                            |r13-2266-g8bb1df032cc080b7

--- Comment #8 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r13-2266-g8bb1df032cc080b7.

[Bug c++/106824] [13 Regression] ICE in set_nan, at value-range.cc:283 since r13-2266-g8bb1df032cc080b7

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

--- Comment #9 from Martin Liška <marxin at gcc dot gnu.org> ---
BT:

g++ bug840.cc -c -O2 -march=bdver2
during GIMPLE pass: thread
bug840.cc: In function ‘void internal::ShortestPath()’:
bug840.cc:68:6: internal compiler error: in set_nan, at value-range.cc:283
   68 | void ShortestPath() {
      |      ^~~~~~~~~~~~
0x91a2b3 frange::set_nan(fp_prop::kind)
        /home/marxin/Programming/gcc/gcc/value-range.cc:283
0x21c1725 foperator_equal::op1_range(frange&, tree_node*, irange const&, frange
const&, relation_kind_t) const
        /home/marxin/Programming/gcc/gcc/range-op-float.cc:364
0x20a3d46 gimple_range_calc_op1(vrange&, gimple const*, vrange const&, vrange
const&)
        /home/marxin/Programming/gcc/gcc/gimple-range-gori.cc:80
0x20a6d3d gori_compute::compute_operand1_range(vrange&, gimple*, vrange const&,
tree_node*, fur_source&)
        /home/marxin/Programming/gcc/gcc/gimple-range-gori.cc:1019
0x20a939b gori_compute::outgoing_edge_range_p(vrange&, edge_def*, tree_node*,
range_query&)
        /home/marxin/Programming/gcc/gcc/gimple-range-gori.cc:1270
0x1443c95 path_range_query::compute_ranges_in_block(basic_block_def*)
        /home/marxin/Programming/gcc/gcc/gimple-range-path.cc:454
0x1444132 path_range_query::compute_ranges(bitmap_head const*)
        /home/marxin/Programming/gcc/gcc/gimple-range-path.cc:622
0x14cd837 back_threader::find_taken_edge_cond(vec<basic_block_def*, va_heap,
vl_ptr> const&, gcond*)
        /home/marxin/Programming/gcc/gcc/tree-ssa-threadbackward.cc:333
0x14cd9e6 back_threader::maybe_register_path(back_threader_profitability&)
        /home/marxin/Programming/gcc/gcc/tree-ssa-threadbackward.cc:248
0x14cdeb8 back_threader::find_paths_to_names(basic_block_def*, bitmap_head*,
unsigned int, back_threader_profitability&)
        /home/marxin/Programming/gcc/gcc/tree-ssa-threadbackward.cc:380
0x14ce6b9 back_threader::find_paths_to_names(basic_block_def*, bitmap_head*,
unsigned int, back_threader_profitability&)
        /home/marxin/Programming/gcc/gcc/tree-ssa-threadbackward.cc:502
0x14ce6b9 back_threader::find_paths_to_names(basic_block_def*, bitmap_head*,
unsigned int, back_threader_profitability&)
        /home/marxin/Programming/gcc/gcc/tree-ssa-threadbackward.cc:502
0x14ce6b9 back_threader::find_paths_to_names(basic_block_def*, bitmap_head*,
unsigned int, back_threader_profitability&)
        /home/marxin/Programming/gcc/gcc/tree-ssa-threadbackward.cc:502
0x14ce6b9 back_threader::find_paths_to_names(basic_block_def*, bitmap_head*,
unsigned int, back_threader_profitability&)
        /home/marxin/Programming/gcc/gcc/tree-ssa-threadbackward.cc:502
0x14ceefc back_threader::maybe_thread_block(basic_block_def*)
        /home/marxin/Programming/gcc/gcc/tree-ssa-threadbackward.cc:574
0x14cefa1 back_threader::thread_blocks()
        /home/marxin/Programming/gcc/gcc/tree-ssa-threadbackward.cc:1002
0x14cf008 execute
        /home/marxin/Programming/gcc/gcc/tree-ssa-threadbackward.cc:1104
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug c++/106824] [13 Regression] ICE in set_nan, at value-range.cc:283 since r13-2266-g8bb1df032cc080b7

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |amacleod at redhat dot com
           Assignee|unassigned at gcc dot gnu.org      |aldyh at gcc dot gnu.org

--- Comment #10 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
This is interesting.

We are trying to thread 5->7->8->9->3->??.

The path starts like this:

    <bb 5> [local count: 81335936906]:
    SR.30_3 =  Nan;
    goto <bb 7>; [100.00%]

    <bb 7> [local count: 108447915740]:
    # SR.30_25 = PHI <SR.30_3(5), SR.30_12(6)>
    plus_33 = SR.30_25;
    w1$value__13 = f_distance$D2421$value__1;
    w2$value__14 = plus_33;
    if (w1$value__13 == w2$value__14)
      goto <bb 8>; [50.00%]
    else
      goto <bb 9>; [50.00%]

On the path, SR.30_25 is NAN, which ultimately makes w2$value__14 a NAN.

This means that the 7->8 is impossible on the path.

On the true arm (foperator_equal::op1_range) we are asserting that op1
(w1$value__13) is a !NAN because for the == conditional to succeed, neither
operand can be a NAN.  But...we know that operand 2 is a NAN.  However, op1 ==
op2 and op2 being a NAN is an impossible scenario.

We are ICEing because frange::set_nan() sees the NAN and the desire to set the
NAN flag to NO.  I thought this would never happen, but alas it happens in
threading.  I think the correct thing to do is to set the range to undefined,
which is basically unreachable, and will cause all the right things to happen. 
For that matter, the threader will see that an UNDEFINED range was calculated
in the path and abort trying to investigate paths in that direction.

[Bug middle-end/106824] [13 Regression] ICE in set_nan, at value-range.cc:283 since r13-2266-g8bb1df032cc080b7

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

--- Comment #11 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Created attachment 53539
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53539&action=edit
untested patch

[Bug middle-end/106824] [13 Regression] ICE in set_nan, at value-range.cc:283 since r13-2266-g8bb1df032cc080b7

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

--- Comment #12 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Aldy Hernandez <aldyh@gcc.gnu.org>:

https://gcc.gnu.org/g:ba0db24386107ffa237a2af0d1fdef9030460157

commit r13-2444-gba0db24386107ffa237a2af0d1fdef9030460157
Author: Aldy Hernandez <aldyh@redhat.com>
Date:   Mon Sep 5 15:28:55 2022 +0200

    Do not ICE when updating a NAN to a non-NAN.

    Updating a definite NAN to a definitely not NAN was an assertion
    failure, but it turns out we can have such a scenario while attempting
    to thread an impossible path.  This patch updates the range to
    undefined.

    What happens in the testcase is that we are trying to thread path that
    starts like this:

        <bb 5> [local count: 81335936906]:
        SR.30_3 =  Nan;
        goto <bb 7>; [100.00%]

        <bb 7> [local count: 108447915740]:
        # SR.30_25 = PHI <SR.30_3(5), SR.30_12(6)>
        plus_33 = SR.30_25;
        w1$value__13 = f_distance$D2421$value__1;
        w2$value__14 = plus_33;
        if (w1$value__13 == w2$value__14)
          goto <bb 8>; [50.00%]
        else
          goto <bb 9>; [50.00%]

    On the path, SR.30_25 is NAN, which ultimately makes w2$value__14 a NAN.

    This means that the 7->8 is impossible on the path.

    On the true arm (foperator_equal::op1_range) we are asserting that op1
    (w1$value__13) is a !NAN because for the == conditional to succeed,
    neither operand can be a NAN.  But...we know that operand 2 is a NAN.
    This is an impossible scenario.

    We are ICEing because frange::set_nan() sees the NAN and the desire to
    set the NAN flag to NO.  The correct thing to do is to set the range
    to undefined, which is basically unreachable, and will cause all the
    right things to happen.  For that matter, the threader will see that
    an UNDEFINED range was calculated in the path and abort trying to
    investigate paths in that direction.

            PR middle-end/106824

    gcc/ChangeLog:

            * value-range.cc (frange::set_nan): Set undefined when updating a
            NAN to a non-NAN.

    gcc/testsuite/ChangeLog:

            * g++.dg/pr106824.C: New test.

[Bug middle-end/106824] [13 Regression] ICE in set_nan, at value-range.cc:283 since r13-2266-g8bb1df032cc080b7

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106824

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|REOPENED                    |RESOLVED

--- Comment #13 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
fixed