[Bug tree-optimization/107985] New: [13 Regression] ICE in as_a, at value-range.h:393

[Bug tree-optimization/107985] New: [13 Regression] ICE in as_a, at value-range.h:393

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107985

            Bug ID: 107985
           Summary: [13 Regression] ICE in as_a, at value-range.h:393
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc 13.0.0 20221204 snapshot (g:24b9337d1f1b5197b6498dceb9074319be003449) ICEs
when compiling the following testcase, reduced from
test/Analysis/pointer-to-member.cpp from the clang 15 test suite, w/ -O1
-ftree-vrp -fno-tree-ccp -fno-tree-forwprop -fno-tree-fre:

struct B {
  int f;
};

struct D : public B {
};

void foo() {
  D d;
  d.f = 7;

  int B::* pfb = &B::f;
  int D::* pfd = pfb;
  int v = d.*pfd;
}

% g++-13 -O1 -ftree-vrp -fno-tree-ccp -fno-tree-forwprop -fno-tree-fre -c
bq32p5di.cpp
during GIMPLE pass: evrp
bq32p5di.cpp: In function 'void foo()':
bq32p5di.cpp:15:1: internal compiler error: in as_a, at value-range.h:393
   15 | }
      | ^
0x92a7d7 irange const& as_a<irange>(vrange const&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/value-range.h:393
0x92ac0c irange const& as_a<irange>(vrange const&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/range-op.cc:4502
0x92ac0c range_op_handler::fold_range(vrange&, tree_node*, vrange const&,
vrange const&, relation_trio) const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/range-op.cc:4504
0x2009e48 fold_using_range::range_of_range_op(vrange&,
gimple_range_op_handler&, fur_source&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/gimple-range-fold.cc:565
0x200aba2 fold_using_range::fold_stmt(vrange&, gimple*, fur_source&,
tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/gimple-range-fold.cc:489
0x1ffab24 gimple_ranger::update_stmt(gimple*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/gimple-range.cc:550
0x1377644 update_stmt_operands(function*, gimple*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/tree-ssa-operands.cc:1150
0x1396aee update_stmt_if_modified
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/gimple-ssa.h:185
0x1396aee update_stmt_if_modified
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/gimple-ssa.h:182
0x1396aee substitute_and_fold_dom_walker::before_dom_children(basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/tree-ssa-propagate.cc:935
0x1fc734e dom_walker::walk(basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/domwalk.cc:311
0x139576e substitute_and_fold_engine::substitute_and_fold(basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/tree-ssa-propagate.cc:998
0x149fc57 execute_ranger_vrp(function*, bool, bool)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221204/work/gcc-13-20221204/gcc/tree-vrp.cc:1084

[Bug tree-optimization/107985] [13 Regression] ICE in as_a, at value-range.h:393

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107985

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Most likely OFFSET_TYPE not being handled.

[Bug tree-optimization/107985] [13 Regression] ICE in as_a, at value-range.h:393

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107985

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-12-06

--- Comment #2 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
The dispatch code in range_op_handler::fold_range() is ICEing because LHS is an
irange, whereas op1 is an unsupported type:

(gdb) p debug(r)
[irange] UNDEFINED
(gdb) p debug(lh)
[unsupported_range] UNDEFINED

Going up to range_of_range_op we see:

(gdb) up
#3  0x0000000002ec054f in fold_using_range::range_of_range_op
(this=0x7fffffffcb7f, r=warning: RTTI symbol not found for class
'int_range<255u>'
..., handler=..., src=...) at /home/aldyh/src/gcc/gcc/gimple-range-fold.cc:565
(gdb) p debug(s)
pfd.0_1 = (sizetype) pfb_5;

(gdb) p debug_tree(lhs)
 <ssa_name 0x7fffe9fc40d8
    type <integer_type 0x7fffe9e26000 sizetype public unsigned DI
        size <integer_cst 0x7fffe9e02fc0 constant 64>
        unit-size <integer_cst 0x7fffe9e02fd8 constant 8>
        align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7fffe9e26000 precision:64 min <integer_cst 0x7fffe9e28000 0> max <integer_cst
0x7fffe9e035e0 18446744073709551615>>
    visited
    def_stmt pfd.0_1 = (sizetype) pfb_5;
    version:1>
$7 = void
(gdb) p debug_tree(op1)
 <ssa_name 0x7fffe9fc41f8
    type <offset_type 0x7fffe9fca150
        type <integer_type 0x7fffe9e265e8 int sizes-gimplified public type_6 SI
            size <integer_cst 0x7fffe9e28210 constant 32>
            unit-size <integer_cst 0x7fffe9e28228 constant 4>
            align:32 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7fffe9e265e8 precision:32 min <integer_cst 0x7fffe9e281c8 -2147483648> max
<integer_cst 0x7fffe9e281e0 2147483647>
            pointer_to_this <pointer_type 0x7fffe9e2eb28>>
        sizes-gimplified public DI
        size <integer_cst 0x7fffe9e02fc0 constant 64>
        unit-size <integer_cst 0x7fffe9e02fd8 constant 8>
        align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7fffe9fca150 basetype <record_type 0x7fffe9fae7e0 B>>
    visited var <var_decl 0x7fffe9e11d80 pfb>
    def_stmt pfb_5 = 0;
    version:5>
$8 = void

So we're trying to cast from an offset_type (unsupported) to an integer_type
(irange).  It looks like range_op_handler should have set m_valid to false for
this combination, but m_valid is set from set_op_handler() which only looks at
the LHS.

[Bug tree-optimization/107985] [13 Regression] ICE in as_a, at value-range.h:393

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107985

--- Comment #3 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Another alternative would be to add an is_a/as_a handler for unsupported_type's
in value-range.h and a corresponding entry for unsupported types in
range_operator:

virtual bool fold_range (irange &r, tree type, const unsupported_range &lh,
...);

with a default definition of:

   r.set_varying (type);
   return true;

Finally, add the corresponding dispatch in range_op_handler::fold_range().

Then we could handle any unsupported range's that creep in.

Or...we could fix the range_op_handler code...

[Bug tree-optimization/107985] [13 Regression] ICE in as_a, at value-range.h:393

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107985

--- Comment #4 from Andrew Macleod <amacleod at redhat dot com> ---
the gimple_range_op_handler constructor should check the operands for supported
types as well before setting m_valid.

There is also a ripple effect in gimple_ranger::prefill_stmt_dependencies where
the assumption is that a supported LHS must ave a handler.

Patch in testing...

[Bug tree-optimization/107985] [13 Regression] ICE in as_a, at value-range.h:393

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107985

--- Comment #5 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
(In reply to Andrew Macleod from comment #4)
> the gimple_range_op_handler constructor should check the operands for
> supported types as well before setting m_valid.
> 
> There is also a ripple effect in gimple_ranger::prefill_stmt_dependencies
> where the assumption is that a supported LHS must ave a handler.

Heh heh. I saw the ripple effect when I tried a quick fix, hence why I left it
alone and went back to my vacation.

Thanks for taking care of this.

[Bug tree-optimization/107985] [13 Regression] ICE in as_a, at value-range.h:393

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107985

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Andrew Macleod <amacleod@gcc.gnu.org>:

https://gcc.gnu.org/g:0ef9991d8767932f51fa97753c16058d17b29b18

commit r13-4557-g0ef9991d8767932f51fa97753c16058d17b29b18
Author: Andrew MacLeod <amacleod@redhat.com>
Date:   Tue Dec 6 10:41:29 2022 -0500

    Ensure arguments to range-op handler are supported.

            PR tree-optimization/107985
            gcc/
            * gimple-range-op.cc
            (gimple_range_op_handler::gimple_range_op_handler): Check if type
            of the operands is supported.
            * gimple-range.cc (gimple_ranger::prefill_stmt_dependencies): Do
            not assert if here is no range-op handler.

            gcc/testsuite/
            * g++.dg/pr107985.C: New.

[Bug tree-optimization/107985] [13 Regression] ICE in as_a, at value-range.h:393

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107985

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Assuming this is fixed.