[Bug tree-optimization/107394] New: [13 Regression] ICE in verify_range, at value-range.cc:716

[Bug tree-optimization/107394] New: [13 Regression] ICE in verify_range, at value-range.cc:716

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107394

            Bug ID: 107394
           Summary: [13 Regression] ICE in verify_range, at
                    value-range.cc:716
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc 13.0.0 20221023 snapshot (g:0e37fd4dc74c1db99cdc7d71ef378e1221253c6f) ICEs
when compiling the following testcase w/ -O2:

static double
quux (double x)
{
  return __builtin_fabs (x);
}

__attribute__ ((flatten, optimize ("-ffinite-math-only"))) static int
bar (int *p)
{
  *p = quux (0.0);

  return 0;
}

void
foo (int *p)
{
  (void) bar (p);
}

% gcc-13 -O2 -c owzufzxh.c
during IPA pass: inline
owzufzxh.c: In function 'bar.isra':
owzufzxh.c:10:8: internal compiler error: in verify_range, at
value-range.cc:716
   10 |   *p = quux (0.0);
      |        ^~~~~~~~~~
0x7bca0d frange::verify_range()
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/value-range.cc:716
0x1160ad8 range_info_get_range(tree_node*, vrange&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-ssanames.cc:121
0x1160ad8 duplicate_ssa_name_range_info(tree_node*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-ssanames.cc:750
0xf85de3 remap_ssa_name
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-inline.cc:256
0xf8bf37 remap_gimple_op_r
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-inline.cc:1028
0x12179c3 walk_tree_1(tree_node**, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*,
tree_node* (*)(tree_node**, int*, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*))
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree.cc:11270
0xbf1a92 walk_gimple_op(gimple*, tree_node* (*)(tree_node**, int*, void*),
walk_stmt_info*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/gimple-walk.cc:221
0xf886bf remap_gimple_stmt
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-inline.cc:1986
0xf8cb87 copy_bb
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-inline.cc:2056
0xf8e87c copy_cfg_body
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-inline.cc:3090
0xf8e87c copy_body
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-inline.cc:3343
0xf93452 expand_call_inline
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-inline.cc:5128
0xf95411 gimple_expand_calls_inline
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-inline.cc:5323
0xf95411 optimize_inline_calls(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/tree-inline.cc:5495
0xc9653b inline_transform(cgraph_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/ipa-inline-transform.cc:790
0xe0d116 execute_one_ipa_transform_pass
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/passes.cc:2336
0xe0d116 execute_all_ipa_transforms(bool)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/passes.cc:2399
0xa463dd cgraph_node::expand()
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/cgraphunit.cc:1827
0xa463dd cgraph_node::expand()
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/cgraphunit.cc:1787
0xa47a1e expand_all_functions
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221023/work/gcc-13-20221023/gcc/cgraphunit.cc:2008

[Bug tree-optimization/107394] [13 Regression] ICE in verify_range, at value-range.cc:716

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107394

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0

[Bug tree-optimization/107394] [13 Regression] ICE in verify_range, at value-range.cc:716 since r13-3411-gf4fda3eec408e1eb

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107394

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org
            Summary|[13 Regression] ICE in      |[13 Regression] ICE in
                   |verify_range, at            |verify_range, at
                   |value-range.cc:716          |value-range.cc:716 since
                   |                            |r13-3411-gf4fda3eec408e1eb
   Last reconfirmed|                            |2022-10-25

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r13-3411-gf4fda3eec408e1eb.

[Bug tree-optimization/107394] [13 Regression] ICE in verify_range, at value-range.cc:716 since r13-3411-gf4fda3eec408e1eb

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107394

--- Comment #2 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
This is interesting.  

quux() was analyzed and a global range was set that included the possibility of
+NAN, but when it was inlined into bar(), the assert making sure no NANs crept
in for -ffinite-math-only failed.

So the inlined function had a NAN, but the function where it was being inlined
into has -ffinite-math-only.

[Bug tree-optimization/107394] [13 Regression] ICE in verify_range, at value-range.cc:716 since r13-3411-gf4fda3eec408e1eb

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107394

--- Comment #3 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Created attachment 53772
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53772&action=edit
untested

[Bug tree-optimization/107394] [13 Regression] ICE in verify_range, at value-range.cc:716 since r13-3411-gf4fda3eec408e1eb

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107394

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug tree-optimization/107394] [13 Regression] ICE in verify_range, at value-range.cc:716 since r13-3411-gf4fda3eec408e1eb

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107394

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Aldy Hernandez <aldyh@gcc.gnu.org>:

https://gcc.gnu.org/g:2b1fb720818a85d5c893ce65d140add40debf2ff

commit r13-3525-g2b1fb720818a85d5c893ce65d140add40debf2ff
Author: Aldy Hernandez <aldyh@redhat.com>
Date:   Tue Oct 25 22:44:51 2022 +0200

    [PR tree-optimization/107394] Canonicalize global franges as they are read
back.

    The problem here is that we're inlining a global range with NANs into
    a function that has been tagged with __attribute__((optimize
    ("-ffinite-math-only"))).  As the global range is copied from
    SSA_NAME_RANGE_INFO, its NAN bits are copied, which then cause
    frange::verify_range() to fail a sanity check making sure no NANs
    creep in when !HONOR_NANS.

    I think what we should do is nuke the NAN bits as we're restoring the
    global range.  For that matter, if we use the frange constructor,
    everything except that NAN sign will be done automatically, including
    dropping INFs to the min/max representable range when appropriate.

            PR tree-optimization/107394

    gcc/ChangeLog:

            * value-range-storage.cc (frange_storage_slot::get_frange): Use
            frange constructor.

    gcc/testsuite/ChangeLog:

            * gcc.dg/tree-ssa/pr107394.c: New test.

[Bug tree-optimization/107394] [13 Regression] ICE in verify_range, at value-range.cc:716 since r13-3411-gf4fda3eec408e1eb

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107394

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #5 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
fixed