[Bug tree-optimization/106970] New: [13 Regression] ICE in verify_range, at value-range.cc:702

[Bug tree-optimization/106970] New: [13 Regression] ICE in verify_range, at value-range.cc:702

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106970

            Bug ID: 106970
           Summary: [13 Regression] ICE in verify_range, at
                    value-range.cc:702
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc 13.0.0 20220918 snapshot (g:313879d8768d08dea035efd7fd62b753dc91c364) ICEs
when compiling the following testcase w/ -O1 -fno-signed-zeros:

void
foo (double x, double y)
{
  if (!x == !y * -1.0)
    __builtin_trap ();
}

% gcc-13.0.0 -O1 -fno-signed-zeros -c kis6ezgv.c
during GIMPLE pass: ethread
kis6ezgv.c: In function 'foo':
kis6ezgv.c:6:1: internal compiler error: in verify_range, at value-range.cc:702
    6 | }
      | ^
0x7b68a9 frange::verify_range()
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/value-range.cc:702
0x12106b7 frange::intersect(vrange const&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/value-range.cc:549
0x1e62c88 foperator_equal::fold_range(irange&, tree_node*, frange const&,
frange const&, relation_kind_t) const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/range-op-float.cc:382
0x1e62e50 foperator_equal::fold_range(irange&, tree_node*, frange const&,
frange const&, relation_kind_t) const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/range-op.h:219
0x1d407b7 fold_using_range::range_of_range_op(vrange&, gimple*, fur_source&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/gimple-range-fold.cc:634
0x1d438d0 fold_using_range::fold_stmt(vrange&, gimple*, fur_source&,
tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/gimple-range-fold.cc:555
0x1d43c9c fold_range(vrange&, gimple*, range_query*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/gimple-range-fold.cc:316
0x10a647d path_range_query::range_of_stmt(vrange&, gimple*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/gimple-range-path.cc:725
0x1130994 back_threader::find_taken_edge_cond(vec<basic_block_def*, va_heap,
vl_ptr> const&, gcond*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/tree-ssa-threadbackward.cc:334
0x1130b82 back_threader::maybe_register_path(back_threader_profitability&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/tree-ssa-threadbackward.cc:248
0x1131098 back_threader::find_paths_to_names(basic_block_def*, bitmap_head*,
unsigned int, back_threader_profitability&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/tree-ssa-threadbackward.cc:380
0x1131614 back_threader::find_paths_to_names(basic_block_def*, bitmap_head*,
unsigned int, back_threader_profitability&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/tree-ssa-threadbackward.cc:502
0x1131614 back_threader::find_paths_to_names(basic_block_def*, bitmap_head*,
unsigned int, back_threader_profitability&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/tree-ssa-threadbackward.cc:502
0x11320af back_threader::maybe_thread_block(basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/tree-ssa-threadbackward.cc:574
0x1132161 back_threader::thread_blocks()
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/tree-ssa-threadbackward.cc:1002
0x11322b0 execute
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220918/work/gcc-13-20220918/gcc/tree-ssa-threadbackward.cc:1076

[Bug tree-optimization/106970] [13 Regression] ICE in verify_range, at value-range.cc:702 since r13-2713-g917461478d3bb733

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106970

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-09-20
     Ever confirmed|0                           |1
            Summary|[13 Regression] ICE in      |[13 Regression] ICE in
                   |verify_range, at            |verify_range, at
                   |value-range.cc:702          |value-range.cc:702 since
                   |                            |r13-2713-g917461478d3bb733
   Target Milestone|---                         |13.0
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com,
                   |                            |marxin at gcc dot gnu.org

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Also started with r13-2713-g917461478d3bb733.

[Bug tree-optimization/106970] [13 Regression] ICE in verify_range, at value-range.cc:702 since r13-2713-g917461478d3bb733

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106970

--- Comment #2 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Works on mainline.  I can add a testcase though.

[Bug tree-optimization/106970] [13 Regression] ICE in verify_range, at value-range.cc:702 since r13-2713-g917461478d3bb733

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106970

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Aldy Hernandez <aldyh@gcc.gnu.org>:

https://gcc.gnu.org/g:3e41e69ab2d85f6756d5217a3d87ada559691e0d

commit r13-2736-g3e41e69ab2d85f6756d5217a3d87ada559691e0d
Author: Aldy Hernandez <aldyh@redhat.com>
Date:   Tue Sep 20 16:06:05 2022 +0200

    [PR106970] New test for PR that has already been fixed.

            PR tree-optimization/106970

    gcc/testsuite/ChangeLog:

            * gcc.dg/tree-ssa/pr106970.c: New test.

[Bug tree-optimization/106970] [13 Regression] ICE in verify_range, at value-range.cc:702 since r13-2713-g917461478d3bb733

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106970

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |WORKSFORME

--- Comment #4 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
already fixed in trunk.  adding a testcase just in case

[Bug tree-optimization/106970] [13 Regression] ICE in verify_range, at value-range.cc:702 since r13-2713-g917461478d3bb733

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106970

David Binderman <dcb314 at hotmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dcb314 at hotmail dot com

--- Comment #5 from David Binderman <dcb314 at hotmail dot com> ---
Created attachment 53594
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53594&action=edit
C source code

Recent gcc, including Aldy's patch, does this:

$ ../results/bin/gcc -c -w -Ofast bug848.c
during GIMPLE pass: ethread
script-object.c: In function ‘script_obj_cmp’:
script-object.c:613:1: internal compiler error: in lower_bound, at
value-range.h:342
0x1c52996 foperator_gt::fold_range(irange&, tree_node*, frange const&, frange
const&, relation_kind_t) const
        ../../trunk.git/gcc/range-op-float.cc:0

[Bug tree-optimization/106970] [13 Regression] ICE in verify_range, at value-range.cc:702 since r13-2713-g917461478d3bb733

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106970

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|WORKSFORME                  |DUPLICATE

--- Comment #6 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Considering comment #5, this is then a duplicate of PR106967.

I have verified that the patch in testing in PR106967 fixes it.

*** This bug has been marked as a duplicate of bug 106967 ***

[Bug tree-optimization/106970] [13 Regression] ICE in verify_range, at value-range.cc:702 since r13-2713-g917461478d3bb733

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106970

--- Comment #7 from David Binderman <dcb314 at hotmail dot com> ---
I am not too sure that what I found is the same as the original bug report.

Reduced C code is:

int script_obj_as_number_obj, script_obj_as_number_obj_0_0;

double script_obj_as_number() {
  if (script_obj_as_number_obj)
    return script_obj_as_number_obj_0_0;
  return __builtin_nanf("");
}
void script_obj_cmp() {
  double num_b = script_obj_as_number();
  if (0 < num_b)
    return;
}

This code crashes with gcc from an hour or so ago, with git hash
d99821624c340429.

I would be grateful if Aldy could confirm that the above code works fine
in his version with -Ofast.

My apologies for not making clear which version of gcc trunk I meant.

[Bug tree-optimization/106970] [13 Regression] ICE in verify_range, at value-range.cc:702 since r13-2713-g917461478d3bb733

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106970

--- Comment #8 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
abulafia:~/bld/t/gcc$ cat a.c
int script_obj_as_number_obj, script_obj_as_number_obj_0_0;

double script_obj_as_number() {
  if (script_obj_as_number_obj)
    return script_obj_as_number_obj_0_0;
  return __builtin_nanf("");
}
void script_obj_cmp() {
  double num_b = script_obj_as_number();
  if (0 < num_b)
    return;
}
abulafia:~/bld/t/gcc$ ./cc1 a.c -Ofast -quiet
abulafia:~/bld/t/gcc$ 

works for me ;-)