[Bug tree-optimization/107570] New: [13 Regression] ICE: Segmentation fault (in instantiate_scev_name/gimple_bb)

[Bug tree-optimization/107570] New: [13 Regression] ICE: Segmentation fault (in instantiate_scev_name/gimple_bb)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107570

            Bug ID: 107570
           Summary: [13 Regression] ICE: Segmentation fault (in
                    instantiate_scev_name/gimple_bb)
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc 13.0.0 20221106 snapshot (g:c56826d0f3b143a9cb64ee263707046f8073c1b6) ICEs
when compiling the following testcase w/ -Os:

long int n;

void
foo (int *p, int x)
{
  for (;;)
    {
      for (*p = 0; *p < 1; ++*p)
        {
          n += *p < 0;
          if (n < x)
            {
              while (x < 1)
                ++x;

              __builtin_unreachable ();
            }
        }

      p = &x;
    }
}

% gcc-13 -Os -c dpim0i6y.c
during GIMPLE pass: vrp
dpim0i6y.c: In function 'foo':
dpim0i6y.c:4:1: internal compiler error: Segmentation fault
    4 | foo (int *p, int x)
      | ^~~
0xf0e7af crash_signal
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/toplev.cc:314
0xff9e27 gimple_bb
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/gimple.h:1904
0xff9e27 instantiate_scev_name
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/tree-scalar-evolution.cc:2270
0xff9e27 instantiate_scev_r
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/tree-scalar-evolution.cc:2644
0xff9cec instantiate_scev_poly
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/tree-scalar-evolution.cc:2424
0xff9cec instantiate_scev_r
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/tree-scalar-evolution.cc:2649
0xffa8c2 instantiate_scev(edge_def*, loop*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/tree-scalar-evolution.cc:2726
0x129350a instantiate_parameters
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/tree-scalar-evolution.h:63
0x129350a bounds_of_var_in_loop(tree_node**, tree_node**, range_query*, loop*,
gimple*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/vr-values.cc:1672
0x1d78ff3 fold_using_range::range_of_ssa_name_with_loop_info(vrange&,
tree_node*, loop*, gphi*, fur_source&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/gimple-range-fold.cc:957
0x1d79bab fold_using_range::range_of_phi(vrange&, gphi*, fur_source&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/gimple-range-fold.cc:820
0x1d7c4d8 fold_using_range::fold_stmt(vrange&, gimple*, fur_source&,
tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/gimple-range-fold.cc:491
0x1d6e183 gimple_ranger::fold_range_internal(vrange&, gimple*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/gimple-range.cc:257
0x1d6e183 gimple_ranger::range_of_stmt(vrange&, gimple*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/gimple-range.cc:318
0x1d6cab7 gimple_ranger::range_on_entry(vrange&, basic_block_def*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/gimple-range.cc:153
0x11f2436 remove_unreachable::remove_and_update_globals(bool)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/tree-vrp.cc:151
0x11f66ba remove_unreachable::remove_and_update_globals(bool)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/tree-vrp.cc:4536
0x11f66ba execute_ranger_vrp(function*, bool, bool)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221106/work/gcc-13-20221106/gcc/tree-vrp.cc:4536

[Bug tree-optimization/107570] [13 Regression] ICE: Segmentation fault (in instantiate_scev_name/gimple_bb)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107570

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-11-08
           Priority|P3                          |P1
   Target Milestone|---                         |13.0
     Ever confirmed|0                           |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
#1  0x000000000167403c in instantiate_scev_name (
    instantiate_below=<edge 0x7ffff66ea330 (3 -> 7)>, 
    evolution_loop=0x7ffff651a848, inner_loop=0x7ffff651a848, chrec=
    <ssa_name 0x7ffff6522f30 2>, fold_conversions=0x0, size_expr=2)
    at /home/rguenther/src/trunk/gcc/tree-scalar-evolution.cc:2270
2270      basic_block def_bb = gimple_bb (SSA_NAME_DEF_STMT (chrec));
(gdb) p chrec
$1 = <ssa_name 0x7ffff6522f30 2>
(gdb) p debug_tree (chrec)
 <ssa_name 0x7ffff6522f30 type <error_mark 0x7ffff6517d80>
    nothrow
    def_stmt 
    version:2 in-free-list>
$2 = void

and we release the SSA name via

#0  release_ssa_name_fn (fn=0x7ffff66e9000, var=<ssa_name 0x7ffff6522f30 2>)
    at /home/rguenther/src/trunk/gcc/tree-ssanames.cc:555
#1  0x000000000187eeae in release_ssa_name (name=<ssa_name 0x7ffff6522f30 2>)
    at /home/rguenther/src/trunk/gcc/tree-ssanames.h:123
#2  0x0000000001881c24 in release_defs (stmt=<gimple_assign 0x7ffff66d1730>)
    at /home/rguenther/src/trunk/gcc/tree-ssanames.cc:832
#3  0x00000000017bd61c in substitute_and_fold_engine::substitute_and_fold (
    this=0x7fffffffda00, block=<basic_block 0x0>)
    at /home/rguenther/src/trunk/gcc/tree-ssa-propagate.cc:1009
#4  0x000000000193e886 in execute_ranger_vrp (fun=0x7ffff66e9000, 
    warn_array_bounds_p=false, final_p=true)
    at /home/rguenther/src/trunk/gcc/tree-vrp.cc:4543
#5  0x000000000193ebde in (anonymous namespace)::pass_vrp::execute (
    this=0x43b16f0, fun=0x7ffff66e9000)
    at /home/rguenther/src/trunk/gcc/tree-vrp.cc:4628
#6  0x00000000013b2c9d in execute_one_pass (
    pass=<opt_pass* 0x43b16f0 "vrp"(204)>)
    at /home/rguenther/src/trunk/gcc/passes.cc:2644

releasing SSA names while still folding looks dangerous in case the folding
eventually invokes SCEV which has a cache.

[Bug tree-optimization/107570] [13 Regression] ICE: Segmentation fault (in instantiate_scev_name/gimple_bb) since r13-3595-g7b1cdca6d6d594a8

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107570

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13 Regression] ICE:        |[13 Regression] ICE:
                   |Segmentation fault (in      |Segmentation fault (in
                   |instantiate_scev_name/gimpl |instantiate_scev_name/gimpl
                   |e_bb)                       |e_bb) since
                   |                            |r13-3595-g7b1cdca6d6d594a8
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r13-3595-g7b1cdca6d6d594a8.

[Bug tree-optimization/107570] [13 Regression] ICE: Segmentation fault (in instantiate_scev_name/gimple_bb) since r13-3595-g7b1cdca6d6d594a8

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107570

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Aldy/Andrew, any ideas about this?

[Bug tree-optimization/107570] [13 Regression] ICE: Segmentation fault (in instantiate_scev_name/gimple_bb) since r13-3595-g7b1cdca6d6d594a8

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107570

--- Comment #4 from Andrew Macleod <amacleod at redhat dot com> ---
(In reply to Jakub Jelinek from comment #3)
> Aldy/Andrew, any ideas about this?

patch already in testing.

[Bug tree-optimization/107570] [13 Regression] ICE: Segmentation fault (in instantiate_scev_name/gimple_bb) since r13-3595-g7b1cdca6d6d594a8

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107570

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Andrew Macleod <amacleod@gcc.gnu.org>:

https://gcc.gnu.org/g:093e2e1b201c0f324e0d8bfe6487aa2d470a13e7

commit r13-5694-g093e2e1b201c0f324e0d8bfe6487aa2d470a13e7
Author: Andrew MacLeod <amacleod@redhat.com>
Date:   Wed Feb 1 11:46:18 2023 -0500

    Reset SCEV before removing unreachable globals.

    SCEV should be reset in VRP before trying to remove unreachable globals
    to avoid triggering issues with it's cache.

            PR tree-optimization/107570
            gcc/
            * tree-vrp.cc (remove_and_update_globals): Reset SCEV.

            gcc/testsuite/
            * gcc.dg/pr107570.c: New.

[Bug tree-optimization/107570] [13 Regression] ICE: Segmentation fault (in instantiate_scev_name/gimple_bb) since r13-3595-g7b1cdca6d6d594a8

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107570

Andrew Macleod <amacleod at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #6 from Andrew Macleod <amacleod at redhat dot com> ---
Fixed.