[Bug tree-optimization/108819] New: ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[Bug tree-optimization/108819] New: ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

            Bug ID: 108819
           Summary: ICE on valid code at -O1 with "-fno-tree-ccp
                    -fno-tree-forwprop" on x86_64-linux-gnu: tree check:
                    expected ssa_name, have integer_cst in
                    number_of_iterations_cltz, at
                    tree-ssa-loop-niter.cc:2394
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

It appears to be a recent regression. 

Compiler Explorer: https://godbolt.org/z/a7zzhcxhz

[570] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/13.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
--with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 13.0.1 20230216 (experimental) [master r13-6073-g441c466fd4d] (GCC)
[571] %
[571] % gcctk -O1 small.c; ./a.out
[572] %
[572] % gcctk -O1 -fno-tree-ccp -fno-tree-forwprop small.c
during GIMPLE pass: ivcanon
small.c: In function ‘main’:
small.c:2:5: internal compiler error: tree check: expected ssa_name, have
integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394
    2 | int main() {
      |     ^~~~
0x7a8f41 tree_check_failed(tree_node const*, char const*, int, char const*,
...)
        ../../gcc-trunk/gcc/tree.cc:8909
0x78196d tree_check(tree_node*, char const*, int, char const*, tree_code)
        ../../gcc-trunk/gcc/tree.h:3530
0x78196d number_of_iterations_cltz
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:2394
0x10838e2 number_of_iterations_exit_assumptions(loop*, edge_def*,
tree_niter_desc*, gcond**, bool, basic_block_def**)
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:3287
0x10838e2 number_of_iterations_exit(loop*, edge_def*, tree_niter_desc*, bool,
bool, basic_block_def**)
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:3274
0x1083e08 estimate_numbers_of_iterations(loop*)
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:4844
0x1086685 estimate_numbers_of_iterations(function*)
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:5072
0x105aad6 canonicalize_induction_variables()
        ../../gcc-trunk/gcc/tree-ssa-loop-ivcanon.cc:1293
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[573] %
[573] % cat small.c
int a, b;
int main() {
  int d = 1;
  for (; b; b++)
    if (a < 1)
      while (d <= a && a <= 0UL) {
        int *e = &d;
        *e = 0;
      }
  return 0;
}

[Bug tree-optimization/108819] [13 Regression] ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
   Target Milestone|---                         |13.0
            Summary|ICE on valid code at -O1    |[13 Regression] ICE on
                   |with "-fno-tree-ccp         |valid code at -O1 with
                   |-fno-tree-forwprop" on      |"-fno-tree-ccp
                   |x86_64-linux-gnu: tree      |-fno-tree-forwprop" on
                   |check: expected ssa_name,   |x86_64-linux-gnu: tree
                   |have integer_cst in         |check: expected ssa_name,
                   |number_of_iterations_cltz,  |have integer_cst in
                   |at                          |number_of_iterations_cltz,
                   |tree-ssa-loop-niter.cc:2394 |at
                   |                            |tree-ssa-loop-niter.cc:2394
            Version|unknown                     |13.0

[Bug tree-optimization/108819] [12/13 Regression] ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|13.0                        |12.3
             Status|UNCONFIRMED                 |NEW
            Summary|[13 Regression] ICE on      |[12/13 Regression] ICE on
                   |valid code at -O1 with      |valid code at -O1 with
                   |"-fno-tree-ccp              |"-fno-tree-ccp
                   |-fno-tree-forwprop" on      |-fno-tree-forwprop" on
                   |x86_64-linux-gnu: tree      |x86_64-linux-gnu: tree
                   |check: expected ssa_name,   |check: expected ssa_name,
                   |have integer_cst in         |have integer_cst in
                   |number_of_iterations_cltz,  |number_of_iterations_cltz,
                   |at                          |at
                   |tree-ssa-loop-niter.cc:2394 |tree-ssa-loop-niter.cc:2394
   Last reconfirmed|                            |2023-02-16
      Known to work|                            |11.1.0, 11.3.0
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
  _7 = 1 & 1;

That I think is wrong but I think the problem is before ivcanon and it was
latent in GCC 12 even.


reassoc1 produces:
  <bb 4> [local count: 114863530]:
  _20 = a.0_1 == 0;
  _21 = a.0_1 > 0;
  _7 = 1 & 1;
  if (_7 != 0)
    goto <bb 5>; [89.30%]
  else
    goto <bb 6>; [10.70%]

From:
  <bb 4> [local count: 114863530]:
  _20 = a.0_1 == 0;
  _21 = a.0_1 > 0;
  _22 = _20 & _21;
  if (_22 != 0)
    goto <bb 5>; [89.30%]
  else
    goto <bb 6>; [10.70%]

All it has:
Optimizing range tests a.0_1 -[, 0] and +[, 0] and +[0, 0]
 into 0

GCC 11 looks ok though:
From:

  a.0_1 = a;
  if (a.0_1 <= 0)
    goto <bb 4>; [20.45%]
  else
    goto <bb 6>; [79.55%]

  <bb 4> [local count: 114863530]:
  _20 = a.0_1 == 0;
  _21 = a.0_1 > 0;
  _22 = _20 & _21;
  if (_22 != 0)
    goto <bb 5>; [89.30%]
  else
    goto <bb 6>; [10.70%]
to:

  a.0_1 = a;
  _20 = a.0_1 == 0;
  _16 = 0;
  _21 = a.0_1 > 0;
  _7 = 1 & _16;
  if (_7 != 0)
    goto <bb 4>; [89.30%]
  else
    goto <bb 5>; [10.70%]

So I am going to declare this as a latent bug (which the verifiers don't catch
either ...).

[Bug tree-optimization/108819] [12/13 Regression] ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
           Priority|P3                          |P2

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Not exactly "wrong", but yes, passes don't expect this.  I will have a look.

[Bug tree-optimization/108819] [12/13 Regression] ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
I have a patch to make niter analysis more defensive, the 1 & 1 is introduced
by reassoc:

@@ -30,8 +54,8 @@
   <bb 4> [local count: 114863530]:
   _20 = a.0_1 == 0;
   _21 = a.0_1 > 0;
-  _22 = _20 & _21;
-  if (_22 != 0)
+  _7 = 1 & 1;
+  if (_7 != 0)

where update_range_test gets a '1' as result and forces that to an SSA name
and things go downhill from that.  With

diff --git a/gcc/tree-ssa-reassoc.cc b/gcc/tree-ssa-reassoc.cc
index f163612f140..c2b30a03a9d 100644
--- a/gcc/tree-ssa-reassoc.cc
+++ b/gcc/tree-ssa-reassoc.cc
@@ -2950,6 +2950,9 @@ update_range_test (struct range_entry *range, struct
range_entry *otherrange,
     }
   if (stmt == NULL)
     gcc_checking_assert (tem == op);
+  /* When range->exp is a constant, we can use it as-is.  */
+  else if (is_gimple_min_invariant (tem))
+    ;
   /* In rare cases range->exp can be equal to lhs of stmt.
      In that case we have to insert after the stmt rather then before
      it.  If stmt is a PHI, insert it at the start of the basic block.  */

this is resolved (but we still get the intermediate 1 & 1 created).  Jakub,
you know this code more(?), can you see whether there's a better place to
handle this?

I'm testing the niter fortification.

[Bug tree-optimization/108819] [12/13 Regression] ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #3)
> --- a/gcc/tree-ssa-reassoc.cc
> +++ b/gcc/tree-ssa-reassoc.cc
> @@ -2950,6 +2950,9 @@ update_range_test (struct range_entry *range, struct
> range_entry *otherrange,
>      }
>    if (stmt == NULL)
>      gcc_checking_assert (tem == op);
> +  /* When range->exp is a constant, we can use it as-is.  */
> +  else if (is_gimple_min_invariant (tem))
> +    ;
>    /* In rare cases range->exp can be equal to lhs of stmt.
>       In that case we have to insert after the stmt rather then before
>       it.  If stmt is a PHI, insert it at the start of the basic block.  */

That would make things worse, not better (i.e. constants could appear more
often and we could trigger these problems more often), no?
forwprop/ccp etc. should optimize it later...

I wonder if we just can't do:
--- gcc/tree-ssa-reassoc.cc.jj  2023-02-16 10:41:11.000000000 +0100
+++ gcc/tree-ssa-reassoc.cc     2023-02-17 17:43:52.169452832 +0100
@@ -4687,6 +4687,8 @@ update_ops (tree var, enum tree_code cod
       gimple_set_uid (g, gimple_uid (stmt));
       gimple_set_visited (g, true);
       gsi_insert_before (&gsi, g, GSI_SAME_STMT);
+      gimple_stmt_iterator gsi2 = gsi_for_stmt (g);
+      fold_stmt_inplace (&gsi2);
     }
   return var;
 }
or if the in-place folding wouldn't be appropriate, at least fold it by hand if
both arguments are constants.  Though, there is also the case of commutative
ops and just the first one turned into constant etc.

[Bug tree-optimization/108819] [12/13 Regression] ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:32b5875c911f80d551d006d7473e6f1f8705857a

commit r13-6132-g32b5875c911f80d551d006d7473e6f1f8705857a
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Feb 18 12:40:49 2023 +0100

    reassoc: Fold some statements [PR108819]

    This spot in update_ops can replace one or both of the assign operands with
    constants, creating 1 & 1 and similar expressions which can confuse later
    passes until they are folded.  Rather than folding both constants by hand
    and also handling swapping of operands for commutative ops if the first one
    is constant and second one is not, the following patch just uses
    fold_stmt_inplace to do that.  I think we shouldn't fold more than the
    single statement because that could screw up the rest of the pass, we'd
have
    to mark all those with uids, visited and the like.

    2023-02-18  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/108819
            * tree-ssa-reassoc.cc (update_ops): Fold new stmt in place.

            * gcc.dg/pr108819.c: New test.

[Bug tree-optimization/108819] [12 Regression] ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13 Regression] ICE on   |[12 Regression] ICE on
                   |valid code at -O1 with      |valid code at -O1 with
                   |"-fno-tree-ccp              |"-fno-tree-ccp
                   |-fno-tree-forwprop" on      |-fno-tree-forwprop" on
                   |x86_64-linux-gnu: tree      |x86_64-linux-gnu: tree
                   |check: expected ssa_name,   |check: expected ssa_name,
                   |have integer_cst in         |have integer_cst in
                   |number_of_iterations_cltz,  |number_of_iterations_cltz,
                   |at                          |at
                   |tree-ssa-loop-niter.cc:2394 |tree-ssa-loop-niter.cc:2394

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed on the trunk so far.

[Bug tree-optimization/108819] [12 Regression] ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ca31bc3366c533a55bfd7f1b9f4959c0c9869a7b

commit r13-6137-gca31bc3366c533a55bfd7f1b9f4959c0c9869a7b
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Feb 17 14:21:39 2023 +0100

    tree-optimization/108819 - niter analysis ICE with unexpected constant

    The following makes sure we do not ICE on unfolded stmts like
    _1 = 1 & 1.

            PR tree-optimization/108819
            * tree-ssa-loop-niter.cc (number_of_iterations_cltz): Check
            we have an SSA name as iv_2 as expected.

[Bug tree-optimization/108819] [12 Regression] ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:7a596c323a9c6af5e8825d2d99892452da7a4e58

commit r12-9275-g7a596c323a9c6af5e8825d2d99892452da7a4e58
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Feb 18 12:40:49 2023 +0100

    reassoc: Fold some statements [PR108819]

    This spot in update_ops can replace one or both of the assign operands with
    constants, creating 1 & 1 and similar expressions which can confuse later
    passes until they are folded.  Rather than folding both constants by hand
    and also handling swapping of operands for commutative ops if the first one
    is constant and second one is not, the following patch just uses
    fold_stmt_inplace to do that.  I think we shouldn't fold more than the
    single statement because that could screw up the rest of the pass, we'd
have
    to mark all those with uids, visited and the like.

    2023-02-18  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/108819
            * tree-ssa-reassoc.cc (update_ops): Fold new stmt in place.

            * gcc.dg/pr108819.c: New test.

    (cherry picked from commit 32b5875c911f80d551d006d7473e6f1f8705857a)

[Bug tree-optimization/108819] [12 Regression] ICE on valid code at -O1 with "-fno-tree-ccp -fno-tree-forwprop" on x86_64-linux-gnu: tree check: expected ssa_name, have integer_cst in number_of_iterations_cltz, at tree-ssa-loop-niter.cc:2394

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108819

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed also for GCC 12.3.