[Bug c++/106936] New: [13 Regression] ICE in get_value_range, at value-query.cc:170

[Bug c++/106936] New: [13 Regression] ICE in get_value_range, at value-query.cc:170

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106936

            Bug ID: 106936
           Summary: [13 Regression] ICE in get_value_range, at
                    value-query.cc:170
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gscfq@t-online.de
  Target Milestone: ---

Started between 20220717 and 20220724, at -O2+, reduced from
llvm-project-llvmorg-14.0.6/clang/test/Analysis/pointer-to-member.cpp :
(gcc configured with --enable-checking=yes)


$ cat z1.cc
namespace testPointerToMemberMiscCasts2 {
struct B {
  int f;
};
struct L : public B { };
struct R : public B { };
struct D : public L, R { };
  int B::* pb = &B::f;
  int R::* pr = pb;
  int D::* pdr = pr;
}


$ g++-13-20220911 -c z1.cc -O2 -fno-tree-ccp -fno-tree-forwprop -fno-tree-fre
during GIMPLE pass: vrp
z1.cc: In function '(static initializers for z1.cc)':
z1.cc:11:1: internal compiler error: in get_value_range, at value-query.cc:170
   11 | }
      | ^
0x153dd5b range_query::get_value_range(tree_node const*, gimple*)
        ../../gcc/value-query.cc:170
0x15a0aee simplify_using_ranges::simplify_casted_cond(gcond*)
        ../../gcc/vr-values.cc:3720
0x15a3f27 simplify_using_ranges::simplify(gimple_stmt_iterator*)
        ../../gcc/vr-values.cc:4420
0x14ff342 rvrp_folder::fold_stmt(gimple_stmt_iterator*)
        ../../gcc/tree-vrp.cc:4321
0x13d34a6 substitute_and_fold_dom_walker::before_dom_children(basic_block_def*)
        ../../gcc/tree-ssa-propagate.cc:870
0x1f34077 dom_walker::walk(basic_block_def*)
        ../../gcc/domwalk.cc:311
0x13d2525 substitute_and_fold_engine::substitute_and_fold(basic_block_def*)
        ../../gcc/tree-ssa-propagate.cc:987
0x14f38dd execute_ranger_vrp(function*, bool)
        ../../gcc/tree-vrp.cc:4349

[Bug tree-optimization/106936] [13 Regression] ICE in get_value_range, at value-query.cc:170

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106936

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0
           Keywords|                            |needs-bisection
          Component|c++                         |tree-optimization

[Bug tree-optimization/106936] [13 Regression] ICE in get_value_range, at value-query.cc:170 since r13-1815-g8b8103dcd2624936

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106936

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-09-13
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com,
                   |                            |marxin at gcc dot gnu.org
            Summary|[13 Regression] ICE in      |[13 Regression] ICE in
                   |get_value_range, at         |get_value_range, at
                   |value-query.cc:170          |value-query.cc:170 since
                   |                            |r13-1815-g8b8103dcd2624936
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
           Keywords|needs-bisection             |

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r13-1815-g8b8103dcd2624936.

[Bug tree-optimization/106936] [13 Regression] ICE in get_value_range, at value-query.cc:170 since r13-1815-g8b8103dcd2624936

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106936

--- Comment #2 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
This assert was put here to make sure that the legacy get_value_range() wasn't
being called on stuff that legacy couldn't handle (floats, etc), because the
result would ultimately be copied into a value_range_equiv.

In this case, simplify_casted_cond() is calling it on an offset_type which
isn't either an integer nor a pointer, so the assert is failing.  However,
range_of_expr happily punted on it because it couldn't handle it, so we're just
returning VARYING.  As value_range_equiv can store VARYING types of anything
(including types it can't handle), this is fine.

I think the easiest thing to do is remove the assert.  If someone from the non
legacy world tries to get a non integer/pointer range here, it's going to blow
up anyhow because the temporary in get_value_range is int_range_max.

Anywho.  This should do the trick.  I'm in transit to Cauldron.  Could someone
test and push this?  I'd hate to leave what looks like an ICE on valid code
open.

diff --git a/gcc/value-query.cc b/gcc/value-query.cc
index 06ad5fe9708..0bdd670982b 100644
--- a/gcc/value-query.cc
+++ b/gcc/value-query.cc
@@ -167,7 +167,6 @@ range_query::free_value_range_equiv (value_range_equiv *v)
 const class value_range_equiv *
 range_query::get_value_range (const_tree expr, gimple *stmt)
 {
-  gcc_checking_assert (value_range_equiv::supports_p (TREE_TYPE (expr)));
   int_range_max r;
   if (range_of_expr (r, const_cast<tree> (expr), stmt))
     return new (equiv_alloc->allocate ()) value_range_equiv (r);

[Bug tree-optimization/106936] [13 Regression] ICE in get_value_range, at value-query.cc:170 since r13-1815-g8b8103dcd2624936

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106936

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Aldy Hernandez <aldyh@gcc.gnu.org>:

https://gcc.gnu.org/g:12a8d5e2f2e7d7535115e4e105c0f9eb4d50fdad

commit r13-2663-g12a8d5e2f2e7d7535115e4e105c0f9eb4d50fdad
Author: Aldy Hernandez <aldyh@redhat.com>
Date:   Wed Sep 14 14:48:36 2022 +0200

    [PR106936] Remove assert from get_value_range.

    This assert was put here to make sure that the legacy
    get_value_range() wasn't being called on stuff that legacy couldn't
    handle (floats, etc), because the result would ultimately be copied
    into a value_range_equiv.

    In this case, simplify_casted_cond() is calling it on an offset_type
    which is neither an integer nor a pointer.  However, range_of_expr
    happily punted on it, and then the fallthru code set the range to
    VARYING.  As value_range_equiv can store VARYING types of anything
    (including types it can't handle), this is fine.

    The easiest thing to do is remove the assert.  If someone from the non
    legacy world tries to get a non integer/pointer range here, it's going
    to blow up anyhow because the temporary in get_value_range is
    int_range_max.

            PR tree-optimization/106936

    gcc/ChangeLog:

            * value-query.cc (range_query::get_value_range): Remove assert.

    gcc/testsuite/ChangeLog:

            * g++.dg/tree-ssa/pr106936.C: New test.

[Bug tree-optimization/106936] [13 Regression] ICE in get_value_range, at value-query.cc:170 since r13-1815-g8b8103dcd2624936

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106936

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #4 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
fixed