[Bug c/108679] New: ice in modify_call, at ipa-param-manipulation.cc:656

[Bug c/108679] New: ice in modify_call, at ipa-param-manipulation.cc:656

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108679

            Bug ID: 108679
           Summary: ice in modify_call, at ipa-param-manipulation.cc:656
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

For this C code:

struct S1 {
  signed f0;
};
struct S2 {
  struct S1 f2;
  short f8;
} g_18;
g_732, func_6_l_17;
static *func_12();
static func_6(struct S2 p_7) { func_12(func_6_l_17, p_7.f2, g_18, 0); }
*func_12(int, struct S1 p_14) {
  safe_lshift_func_int16_t_s_u();
  safe_unary_minus_func_uint64_t_u();
  g_732 = safe_mul_func_uint8_t_u_u(0, p_14);
}
main() {
  struct S2 l_10 = {3};
  func_6(l_10);
}

compiled by recent gcc, does this:

$ /home/dcb36/gcc/results/bin/gcc -w -O2 -ftrivial-auto-var-init=zero bug881.c 
during IPA pass: inline
bug881.c: In function ‘main’:
bug881.c:18:3: internal compiler error: in modify_call, at
ipa-param-manipulation.cc:656
   18 |   func_6(l_10);
      |   ^~~~~~~~~~~~
0xb64d40 ipa_param_adjustments::modify_call(cgraph_edge*, bool)
        ../../trunk.d1/gcc/ipa-param-manipulation.cc:656

The bug first seems to occur sometime between g:d0a3d55ae4a2656f
and g:1530a9b1f45a7ceb

[Bug ipa/108679] [13 Regression] ice in modify_call, at ipa-param-manipulation.cc:656

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108679

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
   Target Milestone|---                         |13.0
                 CC|                            |marxin at gcc dot gnu.org
            Summary|ice in modify_call, at      |[13 Regression] ice in
                   |ipa-param-manipulation.cc:6 |modify_call, at
                   |56                          |ipa-param-manipulation.cc:6
                   |                            |56
          Component|c                           |ipa

[Bug ipa/108679] [13 Regression] ice in modify_call, at ipa-param-manipulation.cc:656

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108679

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-02-06
           Priority|P3                          |P1
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
           Keywords|                            |needs-bisection

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed with just -O2.

during IPA pass: inline
t.i: In function 'main':
t.i:18:3: internal compiler error: in modify_call, at
ipa-param-manipulation.cc:656
   18 |   func_6(l_10);
      |   ^~~~~~~~~~~~
0x129b0a1 ipa_param_adjustments::modify_call(cgraph_edge*, bool)
        /home/rguenther/src/trunk/gcc/ipa-param-manipulation.cc:656
0xec3b06 cgraph_edge::redirect_call_stmt_to_callee(cgraph_edge*)
        /home/rguenther/src/trunk/gcc/cgraph.cc:1530
0x16a9db7 redirect_all_calls(copy_body_data*, basic_block_def*)
        /home/rguenther/src/trunk/gcc/tree-inline.cc:2990
0x16aa5a3 copy_cfg_body
        /home/rguenther/src/trunk/gcc/tree-inline.cc:3145
0x16aadf8 copy_body
        /home/rguenther/src/trunk/gcc/tree-inline.cc:3326
0x16afd47 expand_call_inline
        /home/rguenther/src/trunk/gcc/tree-inline.cc:5112
0x16b0b2d gimple_expand_calls_inline
        /home/rguenther/src/trunk/gcc/tree-inline.cc:5307
0x16b12f3 optimize_inline_calls(tree_node*)
        /home/rguenther/src/trunk/gcc/tree-inline.cc:5479
0x12452ec inline_transform(cgraph_node*)
        /home/rguenther/src/trunk/gcc/ipa-inline-transform.cc:790

[Bug ipa/108679] [13 Regression] ice in modify_call, at ipa-param-manipulation.cc:656 since r13-4685-g4834e9360f7bf42f

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108679

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13 Regression] ice in      |[13 Regression] ice in
                   |modify_call, at             |modify_call, at
                   |ipa-param-manipulation.cc:6 |ipa-param-manipulation.cc:6
                   |56                          |56 since
                   |                            |r13-4685-g4834e9360f7bf42f
                 CC|                            |jamborm at gcc dot gnu.org
           Keywords|needs-bisection             |

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r13-4685-g4834e9360f7bf42f.

[Bug ipa/108679] [13 Regression] ice in modify_call, at ipa-param-manipulation.cc:656 since r13-4685-g4834e9360f7bf42f

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108679

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jamborm at gcc dot gnu.org

[Bug ipa/108679] [13 Regression] ice in modify_call, at ipa-param-manipulation.cc:656 since r13-4685-g4834e9360f7bf42f

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108679

--- Comment #3 from Martin Jambor <jamborm at gcc dot gnu.org> ---
What happens is that ipa_param_body_adjustments::modify_call_stmt
is confused by the IPA-CP produced scalar constant where it expects a
structure containing just one field of the corresponding type.

It is easy to avoid the situation altogether with just the following
but it means that the caller (in the example func_6) will not entirely
lose the parameter even though we know its contents at compile time
and could re-construct it for the purposes of the call (of func_12).
But the behavior is not worse than GCC 12 and before, so the patch is
probably the right thing to do in stage 4.


diff --git a/gcc/ipa-sra.cc b/gcc/ipa-sra.cc
index 7a2b4dc8608..822fd6262d6 100644
--- a/gcc/ipa-sra.cc
+++ b/gcc/ipa-sra.cc
@@ -3989,7 +3989,7 @@ push_param_adjustments_for_index (isra_func_summary *ifs,
unsigned base_index,
        {
          ipa_argagg_value_list avl (ipcp_ts);
          tree value = avl.get_value (base_index, pa->unit_offset);
-         if (value)
+         if (value && !AGGREGATE_TYPE_P (pa->type))
            {
              if (dump_file)
                fprintf (dump_file, "    - omitting component at byte "

[Bug ipa/108679] [13 Regression] ice in modify_call, at ipa-param-manipulation.cc:656 since r13-4685-g4834e9360f7bf42f

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108679

--- Comment #4 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I have proposed the fix on the mailing list:

https://gcc.gnu.org/pipermail/gcc-patches/2023-February/611978.html

[Bug ipa/108679] [13 Regression] ice in modify_call, at ipa-param-manipulation.cc:656 since r13-4685-g4834e9360f7bf42f

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108679

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Jambor <jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:8b1b1b2d691d5cee4ebc40a01974ad5bccab22f9

commit r13-6003-g8b1b1b2d691d5cee4ebc40a01974ad5bccab22f9
Author: Martin Jambor <mjambor@suse.cz>
Date:   Wed Feb 15 11:38:01 2023 +0100

    ipa: Avoid IPA confusing scalar values and single-field aggregates (PR
108679)

    PR 108679 testcase shows a situation when IPA-CP is able to track a
    scalar constant in a single-field structure that is part of a bigger
    structure.  This smaller structure is however also passed in a few
    calls to other functions, but the two same-but-different entities,
    originally placed at the same offset and with the same size, confuse
    the mechanism that takes care of handling call statements after
    IPA-SRA.

    I think that in stage 4 it is best to revert to GCC 12 behavior in this
    particular case (when IPA-CP detects a constant in a single-field
    structure or a single element array that is part of a bigger aggregate)
    and the patch below does that.  If accepted, I plan to file a
    missed-optimization bug to track that we could use the IPA-CP propagated
    value to re-construct the small aggregate arguments.

    gcc/ChangeLog:

    2023-02-13  Martin Jambor  <mjambor@suse.cz>

            PR ipa/108679
            * ipa-sra.cc (push_param_adjustments_for_index): Do not omit
            creation of non-scalar replacements even if IPA-CP knows their
            contents.

    gcc/testsuite/ChangeLog:

    2023-02-13  Martin Jambor  <mjambor@suse.cz>

            PR ipa/108679
            * gcc.dg/ipa/pr108679.c: New test.

[Bug ipa/108679] [13 Regression] ice in modify_call, at ipa-param-manipulation.cc:656 since r13-4685-g4834e9360f7bf42f

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108679

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #6 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Fixed, thanks for reporting and reducing the testcase.