[Bug tree-optimization/107835] New: [13 Regression] ICE in build2, at tree.cc:5020 since r13-254-gdd3c7873a61019e9

[Bug tree-optimization/107835] New: [13 Regression] ICE in build2, at tree.cc:5020 since r13-254-gdd3c7873a61019e9

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107835

            Bug ID: 107835
           Summary: [13 Regression] ICE in build2, at tree.cc:5020 since
                    r13-254-gdd3c7873a61019e9
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: sayle at gcc dot gnu.org
  Target Milestone: ---

The following crashes:

$ cat test-loop2.ii
template <typename> struct __new_allocator;
template <typename> struct allocator_traits;
template <typename _Tp> struct allocator_traits<__new_allocator<_Tp>> {
  using pointer = _Tp *;
};
struct __alloc_traits : allocator_traits<__new_allocator<int>> {};
template <typename _ForwardIterator, typename _Size, typename _Tp>
_ForwardIterator __uninitialized_default_n_a(_ForwardIterator __first, _Size,
                                             _Tp) {
  unsigned __n;
  for (; __n; --__n, ++__first)
    ;
  return __first;
}
struct _Vector_impl_data {
  __alloc_traits::pointer _M_finish;
  _Vector_impl_data() : _M_finish() {}
};
struct _Vector_base {
  ~_Vector_base();
  _Vector_impl_data _M_impl;
} resize___new_size;
struct Trans_NS_std_vector : _Vector_base {
  void resize() {
    _M_impl._M_finish =
        __uninitialized_default_n_a(_M_impl._M_finish, resize___new_size, 0);
  }
};
template <class> using vector = Trans_NS_std_vector;
struct Platform {
  static void get(vector<Platform> *platforms) { platforms->resize(); }
};
main() {
  vector<Platform> platformList;
  Platform::get(&platformList);
}

$ g++ test-loop2.ii -O2 -fwhole-program -c -w
during GIMPLE pass: sccp
test-loop2.ii: In function ‘int main()’:
test-loop2.ii:33:1: internal compiler error: in build2, at tree.cc:5008
   33 | main() {
      | ^~~~
0x86bfa2 build2(tree_code, tree_node*, tree_node*, tree_node*)
        /home/marxin/Programming/gcc/gcc/tree.cc:5008
0xe0528f build2_loc
        /home/marxin/Programming/gcc/gcc/tree.h:4606
0xe0528f fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        /home/marxin/Programming/gcc/gcc/fold-const.cc:13820
0xe0526a fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        /home/marxin/Programming/gcc/gcc/fold-const.cc:13818
0x1fe6a65 chrec_apply(unsigned int, tree_node*, tree_node*)
        /home/marxin/Programming/gcc/gcc/tree-chrec.cc:632
0x1252b8b compute_overall_effect_of_inner_loop(loop*, tree_node*)
        /home/marxin/Programming/gcc/gcc/tree-scalar-evolution.cc:471
0x1256635 final_value_replacement_loop(loop*)
        /home/marxin/Programming/gcc/gcc/tree-scalar-evolution.cc:3759
0x1305915 execute
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop.cc:411
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/107835] [13 Regression] ICE in build2, at tree.cc:5020 since r13-254-gdd3c7873a61019e9

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107835

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-11-23
     Ever confirmed|0                           |1
   Target Milestone|---                         |13.0
             Status|UNCONFIRMED                 |NEW

[Bug tree-optimization/107835] [13 Regression] ICE in build2, at tree.cc:5020 since r13-254-gdd3c7873a61019e9

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107835

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug tree-optimization/107835] [13 Regression] ICE in build2, at tree.cc:5020 since r13-254-gdd3c7873a61019e9

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107835

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Reduced C testcase (just -O2 is needed):
int *
foo (void)
{
  int *x = 0;
  unsigned n = n;
  for (; n; --n, ++x)
    ;
  return x;
}

[Bug tree-optimization/107835] [13 Regression] ICE in build2, at tree.cc:5020 since r13-254-gdd3c7873a61019e9

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107835

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 53983
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53983&action=edit
gcc13-pr107835.patch

Easiest fix is punt on the new optimization if type is pointer type, in that
case we can't perform the multiplication in the pointer type.

[Bug tree-optimization/107835] [13 Regression] ICE in build2, at tree.cc:5020 since r13-254-gdd3c7873a61019e9

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107835

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:7716ee1e90412f785cba20acffd59fc7461302cb

commit r13-4405-g7716ee1e90412f785cba20acffd59fc7461302cb
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Nov 30 11:44:27 2022 +0100

    tree-chrec: Fix up ICE on pointer multiplication [PR107835]

    r13-254-gdd3c7873a61019e9 added an optimization for {a, +, a} (x-1),
    but as can be seen on the following testcase, the way it is written
    where chrec_fold_multiply is called with type doesn't work for pointers:
                 res = build_int_cst (TREE_TYPE (x), 1);
                 res = chrec_fold_plus (TREE_TYPE (x), x, res);
                 res = chrec_convert_rhs (type, res, NULL);
                 res = chrec_fold_multiply (type, chrecr, res);
    while what we were doing before and what is still used if the condition
    doesn't match is fine:
                 res = chrec_convert_rhs (TREE_TYPE (chrecr), x, NULL);
                 res = chrec_fold_multiply (TREE_TYPE (chrecr), chrecr, res);
                 res = chrec_fold_plus (type, CHREC_LEFT (chrec), res);
    because it performs chrec_fold_multiply on TREE_TYPE (chrecr) and converts
    only afterwards.

    I think the easiest fix is to ignore the new path for pointer types.

    2022-11-30  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/107835
            * tree-chrec.cc (chrec_apply): Don't handle "{a, +, a} (x-1)"
            as "a*x" if type is a pointer type.

            * gcc.c-torture/compile/pr107835.c: New test.

[Bug tree-optimization/107835] [13 Regression] ICE in build2, at tree.cc:5020 since r13-254-gdd3c7873a61019e9

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107835

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.