[Bug tree-optimization/107956] New: [12/13 Regression] ICE: SIGSEGV in contains_struct_check (tree.h:3641) with -fsanitize=float-cast-overflow -ftree-slp-vectorize -fexceptions

[Bug tree-optimization/107956] New: [12/13 Regression] ICE: SIGSEGV in contains_struct_check (tree.h:3641) with -fsanitize=float-cast-overflow -ftree-slp-vectorize -fexceptions

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107956

            Bug ID: 107956
           Summary: [12/13 Regression] ICE: SIGSEGV in
                    contains_struct_check (tree.h:3641) with
                    -fsanitize=float-cast-overflow -ftree-slp-vectorize
                    -fexceptions
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 54007
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54007&action=edit
reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc -O -fsanitize=float-cast-overflow
-fno-delete-dead-exceptions -ftree-slp-vectorize -fexceptions -mavx512f
testcase.c -wrapper valgrind,-q
==25396== Invalid read of size 2
==25396==    at 0x2523A88: contains_struct_check (tree.h:3641)
==25396==    by 0x2523A88: vect_recog_mask_conversion_pattern(vec_info*,
_stmt_vec_info*, tree_node**) (tree-vect-patterns.cc:4967)
==25396==    by 0x2524C98: vect_pattern_recog_1(vec_info*, vect_recog_func*,
_stmt_vec_info*) (tree-vect-patterns.cc:6153)
==25396==    by 0x252C491: vect_pattern_recog(vec_info*)
(tree-vect-patterns.cc:6310)
==25396==    by 0x165225B: vect_slp_analyze_bb_1 (tree-vect-slp.cc:7310)
==25396==    by 0x165225B: vect_slp_region(vec<basic_block_def*, va_heap,
vl_ptr>, vec<data_reference*, va_heap, vl_ptr>, vec<int, va_heap, vl_ptr>*,
unsigned int, loop*) (tree-vect-slp.cc:7419)
==25396==    by 0x165450C: vect_slp_bbs(vec<basic_block_def*, va_heap, vl_ptr>
const&, loop*) (tree-vect-slp.cc:7610)
==25396==    by 0x1654786: vect_slp_function(function*) (tree-vect-slp.cc:7698)
==25396==    by 0x165D3C1: (anonymous
namespace)::pass_slp_vectorize::execute(function*) (tree-vectorizer.cc:1532)
==25396==    by 0x1294D1A: execute_one_pass(opt_pass*) (passes.cc:2644)
==25396==    by 0x129560F: execute_pass_list_1(opt_pass*) (passes.cc:2753)
==25396==    by 0x1295621: execute_pass_list_1(opt_pass*) (passes.cc:2754)
==25396==    by 0x1295621: execute_pass_list_1(opt_pass*) (passes.cc:2754)
==25396==    by 0x1295648: execute_pass_list(function*, opt_pass*)
(passes.cc:2764)
==25396==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==25396== 
during GIMPLE pass: slp
testcase.c: In function 'foo':
testcase.c:5:1: internal compiler error: Segmentation fault
    5 | foo (V v)
      | ^~~
0x139d00f crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:314
0x2523a88 contains_struct_check(tree_node*, tree_node_structure_enum, char
const*, int, char const*)
        /repo/gcc-trunk/gcc/tree.h:3641
0x2523a88 vect_recog_mask_conversion_pattern
        /repo/gcc-trunk/gcc/tree-vect-patterns.cc:4967
0x2524c98 vect_pattern_recog_1
        /repo/gcc-trunk/gcc/tree-vect-patterns.cc:6153
0x252c491 vect_pattern_recog(vec_info*)
        /repo/gcc-trunk/gcc/tree-vect-patterns.cc:6310
0x165225b vect_slp_analyze_bb_1
        /repo/gcc-trunk/gcc/tree-vect-slp.cc:7310
0x165225b vect_slp_region
        /repo/gcc-trunk/gcc/tree-vect-slp.cc:7419
0x165450c vect_slp_bbs
        /repo/gcc-trunk/gcc/tree-vect-slp.cc:7610
0x1654786 vect_slp_function(function*)
        /repo/gcc-trunk/gcc/tree-vect-slp.cc:7698
0x165d3c1 execute
        /repo/gcc-trunk/gcc/tree-vectorizer.cc:1532
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r13-4468-20221202115005-g76dd48f8956-checking-yes-rtl-df-extra-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/13.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--with-cloog --with-ppl --with-isl --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=x86_64-pc-linux-gnu
--with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r13-4468-20221202115005-g76dd48f8956-checking-yes-rtl-df-extra-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 13.0.0 20221202 (experimental) (GCC)

[Bug tree-optimization/107956] [12/13 Regression] ICE: SIGSEGV in contains_struct_check (tree.h:3641) with -fsanitize=float-cast-overflow -ftree-slp-vectorize -fexceptions

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107956

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.3

[Bug tree-optimization/107956] [12/13 Regression] ICE: SIGSEGV in contains_struct_check (tree.h:3641) with -fsanitize=float-cast-overflow -ftree-slp-vectorize -fexceptions

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107956

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-12-04

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
>    .COND_ADD (_7, v_13(D), { 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7 }, { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 });

[Bug tree-optimization/107956] [12/13 Regression] ICE: SIGSEGV in contains_struct_check (tree.h:3641) with -fsanitize=float-cast-overflow -ftree-slp-vectorize -fexceptions

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107956

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
This should fix it:
diff --git a/gcc/tree-vect-patterns.cc b/gcc/tree-vect-patterns.cc
index f6c34bb3263..d9fdb24ee62 100644
--- a/gcc/tree-vect-patterns.cc
+++ b/gcc/tree-vect-patterns.cc
@@ -4964,6 +4964,8 @@ vect_recog_mask_conversion_pattern (vec_info *vinfo,
       else
        {
          lhs = gimple_call_lhs (last_stmt);
+         if (!lhs)
+           return NULL;
          vectype1 = get_vectype_for_scalar_type (vinfo, TREE_TYPE (lhs));
        }

Though I think it has been a latent bug since r9-1741-g2c58d42c3ed599 really.

[Bug tree-optimization/107956] [12/13 Regression] ICE: SIGSEGV in contains_struct_check (tree.h:3641) with -fsanitize=float-cast-overflow -ftree-slp-vectorize -fexceptions

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107956

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.

[Bug tree-optimization/107956] [12/13 Regression] ICE: SIGSEGV in contains_struct_check (tree.h:3641) with -fsanitize=float-cast-overflow -ftree-slp-vectorize -fexceptions

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107956

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:5c11d748564c7ce3b096e87ad350fcddd493e45e

commit r13-4489-g5c11d748564c7ce3b096e87ad350fcddd493e45e
Author: Andrew Pinski <pinskia@gmail.com>
Date:   Mon Dec 5 09:09:52 2022 +0100

    tree-optimization/107956 - ICE with NULL call LHS

    The following adds a missing check for a NULL call LHS in the
    vector pattern recognizer.

            PR tree-optimization/107956
            * tree-vect-patterns.cc (vect_recog_mask_conversion_pattern):
            Check for NULL LHS on masked loads.

[Bug tree-optimization/107956] [12/13 Regression] ICE: SIGSEGV in contains_struct_check (tree.h:3641) with -fsanitize=float-cast-overflow -ftree-slp-vectorize -fexceptions

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107956

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:16debfadbd759f9933b4a62029661f01188ad928

commit r12-8959-g16debfadbd759f9933b4a62029661f01188ad928
Author: Andrew Pinski <pinskia@gmail.com>
Date:   Mon Dec 5 09:09:52 2022 +0100

    tree-optimization/107956 - ICE with NULL call LHS

    The following adds a missing check for a NULL call LHS in the
    vector pattern recognizer.

            PR tree-optimization/107956
            * tree-vect-patterns.cc (vect_recog_mask_conversion_pattern):
            Check for NULL LHS on masked loads.

    (cherry picked from commit 5c11d748564c7ce3b096e87ad350fcddd493e45e)

[Bug tree-optimization/107956] [12/13 Regression] ICE: SIGSEGV in contains_struct_check (tree.h:3641) with -fsanitize=float-cast-overflow -ftree-slp-vectorize -fexceptions

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107956

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |12.2.1, 13.0
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
      Known to fail|12.2.1, 13.0                |12.2.0

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.