[Bug ipa/107925] New: ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[Bug ipa/107925] New: ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

            Bug ID: 107925
           Summary: ICE in update_specialized_profile at
                    gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: jamborm at gcc dot gnu.org, marxin at gcc dot gnu.org,
                    tnfchris at gcc dot gnu.org
  Target Milestone: ---

Created attachment 53985
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53985&action=edit
test-case

Noticed by Tamar and their testers using fancy parameters:

$ g++ -march=native -Ofast -flto=auto --param ipa-cp-eval-threshold=1 *.ii
-fprofile-use
during IPA pass: cp
lto1: internal compiler error: in operator>=, at profile-count.h:999
0x814bcc profile_count::operator>=(profile_count const&) const
        /home/marxin/Programming/gcc/gcc/profile-count.h:999
0x814bcc profile_count::operator>=(profile_count const&) const
        /home/marxin/Programming/gcc/gcc/profile-count.h:991
0x814bcc update_specialized_profile
        /home/marxin/Programming/gcc/gcc/ipa-cp.cc:5082
0x1be1689 perhaps_add_new_callers<tree_node*>
        /home/marxin/Programming/gcc/gcc/ipa-cp.cc:5932
0x1be1689 decide_about_value<tree_node*>
        /home/marxin/Programming/gcc/gcc/ipa-cp.cc:6038
0x1be40cc decide_whether_version_node
        /home/marxin/Programming/gcc/gcc/ipa-cp.cc:6190
0x1be5c02 ipcp_decision_stage
        /home/marxin/Programming/gcc/gcc/ipa-cp.cc:6388
0x1be5c02 ipcp_driver
        /home/marxin/Programming/gcc/gcc/ipa-cp.cc:6576
0x1be5c02 execute
        /home/marxin/Programming/gcc/gcc/ipa-cp.cc:6651

The issue is likely not new in GCC 13, but as it uses profile, I hasn'y
bisected that.

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 53986
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53986&action=edit
test-case

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 53987
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53987&action=edit
gcda file

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-11-29

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
@Martin: Can you please take a look?

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Maybe related to r8-4520-g1bad9c1806ac51 ...

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

--- Comment #5 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
I seem to have the same failure in at least GCC 12 as well.

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jamborm at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #6 from Martin Jambor <jamborm at gcc dot gnu.org> ---
The assert is bogus, the "new" division of unexplained counts in the
case of recursive functions so it can easily happen that what is left
is less than what we're trying to take away.  Having said that, there
are a few more issues with the function, chief among them not dropping
potentially guessed profiles to ipa.

I'm going to test the following:

diff --git a/gcc/ipa-cp.cc b/gcc/ipa-cp.cc
index 4b8dedc0c51..5a6b41cf2d6 100644
--- a/gcc/ipa-cp.cc
+++ b/gcc/ipa-cp.cc
@@ -5093,22 +5093,24 @@ update_specialized_profile (struct cgraph_node
*new_node,
                            profile_count redirected_sum)
 { 
   struct cgraph_edge *cs;
-  profile_count new_node_count, orig_node_count = orig_node->count;
+  profile_count new_node_count, orig_node_count = orig_node->count.ipa ();

   if (dump_file)
     { 
       fprintf (dump_file, "    the sum of counts of redirected  edges is ");
       redirected_sum.dump (dump_file);
+      fprintf (dump_file, "\n    old ipa count of the original node is ");
+      orig_node_count.dump (dump_file);
       fprintf (dump_file, "\n");
     }
   if (!(orig_node_count > profile_count::zero ()))
     return;

-  gcc_assert (orig_node_count >= redirected_sum);
-  
   new_node_count = new_node->count;
   new_node->count += redirected_sum;
-  orig_node->count -= redirected_sum;
+  orig_node->count
+    = lenient_count_portion_handling (orig_node->count - redirected_sum,
+                                     orig_node);

   for (cs = new_node->callees; cs; cs = cs->next_callee)
     cs->count += cs->count.apply_scale (redirected_sum, new_node_count);

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

--- Comment #7 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I have proposed the patch on the mailing list:
https://gcc.gnu.org/pipermail/gcc-patches/2023-February/612506.html

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Jambor <jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:68ba253bda74d6c6e77726d98184a6faee5e7337

commit r13-6666-g68ba253bda74d6c6e77726d98184a6faee5e7337
Author: Martin Jambor <mjambor@suse.cz>
Date:   Tue Mar 14 18:53:16 2023 +0100

    ipa-cp: Fix various issues in update_specialized_profile (PR 107925)

    The patch below fixes various issues in function
    update_specialized_profile.  The main is removal of the assert which
    is bogus in the case of recursive cloning.  The division of
    unexplained counts is guesswork, which then leads to updates of counts
    of recursive edges, which then can be redirected to the new clone and
    their count subtracted from the count and there simply may not be
    enough left in the count of the original node - especially when we
    clone a lot because of using --param ipa-cp-eval-threshold=1.

    The other issue was omission to drop the count of the original node to
    ipa count.  And when calculating the remainder, we should use
    lenient_count_portion_handling to account for partial train runs.
    Finally, the patch adds dumping of the original count which I think
    is useful.

    gcc/ChangeLog:

    2023-02-17  Martin Jambor  <mjambor@suse.cz>

            PR ipa/107925
            * ipa-cp.cc (update_specialized_profile): Drop orig_node_count to
            ipa count, remove assert, lenient_count_portion_handling, dump
            also orig_node_count.

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Jambor <jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:1526ecd739fc6a13329abdcbdbf7c2df57c22177

commit r13-6667-g1526ecd739fc6a13329abdcbdbf7c2df57c22177
Author: Martin Jambor <mjambor@suse.cz>
Date:   Tue Mar 14 18:53:16 2023 +0100

    ipa-cp: Improve updating behavior when profile counts have gone bad

    Looking into the behavior of profile count updating in PR 107925, I
    noticed that an option not considered possible was actually happening,
    and - with the guesswork in place to distribute unexplained counts -
    it simply can happen.  Currently it is handled by dropping the counts
    to local estimated zero, whereas it is probably better to leave the
    count as they are but drop the category to GUESSED_GLOBAL0 - which is
    what profile_count::combine_with_ipa_count in a similar case (or so I
    hope :-)

    gcc/ChangeLog:

    2023-02-20  Martin Jambor  <mjambor@suse.cz>

            PR ipa/107925
            * ipa-cp.cc (update_profiling_info): Drop counts of orig_node to
            global0 instead of zeroing when it does not have as many counts as
            it should.

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

--- Comment #10 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Fixed on trunk so far, I plan to backport it to GCC 12 too.

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Martin Jambor
<jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:c826442f6651bab6f66d3107fb02d38eacbf900e

commit r12-9308-gc826442f6651bab6f66d3107fb02d38eacbf900e
Author: Martin Jambor <mjambor@suse.cz>
Date:   Wed Mar 22 16:59:45 2023 +0100

    ipa-cp: Fix various issues in update_specialized_profile (PR 107925)

    The patch below fixes various issues in function
    update_specialized_profile.  The main is removal of the assert which
    is bogus in the case of recursive cloning.  The division of
    unexplained counts is guesswork, which then leads to updates of counts
    of recursive edges, which then can be redirected to the new clone and
    their count subtracted from the count and there simply may not be
    enough left in the count of the original node - especially when we
    clone a lot because of using --param ipa-cp-eval-threshold=1.

    The other issue was omission to drop the count of the original node to
    ipa count.  And when calculating the remainder, we should use
    lenient_count_portion_handling to account for partial train runs.
    Finally, the patch adds dumping of the original count which I think
    is useful.

    gcc/ChangeLog:

    2023-02-17  Martin Jambor  <mjambor@suse.cz>

            PR ipa/107925
            * ipa-cp.cc (update_specialized_profile): Drop orig_node_count to
            ipa count, remove assert, lenient_count_portion_handling, dump
            also orig_node_count.

    (cherry picked from commit 68ba253bda74d6c6e77726d98184a6faee5e7337)

[Bug ipa/107925] ICE in update_specialized_profile at gcc/ipa-cp.cc:5082 for 531.deepsjeng_r benchmark

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107925

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #12 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Fixed on gcc-12 too now.