[Bug tree-optimization/109417] New: ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[Bug tree-optimization/109417] New: ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109417

            Bug ID: 109417
           Summary: ICE on valid code at -O3 on x86_64-linux-gnu:
                    Segmentation fault
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

This appears to be a recent regression.

Compiler Explorer: https://godbolt.org/z/eM6aG1aYc


[605] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/13.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
--with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 13.0.1 20230405 (experimental) [master r13-7008-gfdc5abbdcfb] (GCC)
[606] %
[606] % gcctk -O2 small.c; ./a.out
[607] %
[607] % gcctk -O3 small.c
during GIMPLE pass: vrp
small.c: In function ‘main’:
small.c:3:5: internal compiler error: Segmentation fault
    3 | int main() {
      |     ^~~~
0xeeb4bf crash_signal
        ../../gcc-trunk/gcc/toplev.cc:314
0x1cea605 gori_compute::may_recompute_p(tree_node*, basic_block_def*, int)
        ../../gcc-trunk/gcc/gimple-range-gori.cc:1322
0x1cda775 ranger_cache::range_from_dom(vrange&, tree_node*, basic_block_def*,
ranger_cache::rfd_mode)
        ../../gcc-trunk/gcc/gimple-range-cache.cc:1462
0x1cdc8e0 ranger_cache::range_from_dom(vrange&, tree_node*, basic_block_def*,
ranger_cache::rfd_mode)
        ../../gcc-trunk/gcc/gimple-range-cache.cc:1426
0x1cdc8e0 ranger_cache::fill_block_cache(tree_node*, basic_block_def*,
basic_block_def*)
        ../../gcc-trunk/gcc/gimple-range-cache.cc:1212
0x1cdd5a4 ranger_cache::block_range(vrange&, basic_block_def*, tree_node*,
bool)
        ../../gcc-trunk/gcc/gimple-range-cache.cc:1039
0x1cd3ce8 gimple_ranger::range_on_entry(vrange&, basic_block_def*, tree_node*)
        ../../gcc-trunk/gcc/gimple-range.cc:156
0x11bde4a remove_unreachable::remove_and_update_globals(bool)
        ../../gcc-trunk/gcc/tree-vrp.cc:156
0x11c066d remove_unreachable::remove_and_update_globals(bool)
        ../../gcc-trunk/gcc/tree-vrp.cc:1104
0x11c066d execute_ranger_vrp(function*, bool, bool)
        ../../gcc-trunk/gcc/tree-vrp.cc:1104
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[608] %
[608] % cat small.c
int printf(const char *, ...);
int c, d, *e, f[1][2], g;
int main() {
  int h = 0, *a = &h, **b[1] = {&a};
  while (e)
    while (g) {
    L:
      for (h = 0; h < 2; h++) {
        while (d)
          for (*e = 0; *e < 1;)
            printf("0");
        while (c)
          ;
        f[g][h] = 0;
      }
    }
  if (h)
    goto L;
  return 0;
}

[Bug tree-optimization/109417] [13 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109417

Xi Ruoyao <xry111 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-04-05
     Ever confirmed|0                           |1
                 CC|                            |xry111 at gcc dot gnu.org
           Keywords|                            |ice-on-valid-code
      Known to work|                            |12.2.0
            Version|unknown                     |13.0
            Summary|ICE on valid code at -O3 on |[13 Regression] ICE on
                   |x86_64-linux-gnu:           |valid code at -O3 on
                   |Segmentation fault          |x86_64-linux-gnu:
                   |                            |Segmentation fault
             Status|UNCONFIRMED                 |NEW

[Bug tree-optimization/109417] [13 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault since r13-6945

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109417

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0
           Priority|P3                          |P1
            Summary|[13 Regression] ICE on      |[13 Regression] ICE on
                   |valid code at -O3 on        |valid code at -O3 on
                   |x86_64-linux-gnu:           |x86_64-linux-gnu:
                   |Segmentation fault          |Segmentation fault since
                   |                            |r13-6945
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com,
                   |                            |jakub at gcc dot gnu.org

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r13-6945-g429a7a88438cc80e

[Bug tree-optimization/109417] [13 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault since r13-6945

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109417

--- Comment #2 from Andrew Macleod <amacleod at redhat dot com> ---
(In reply to Jakub Jelinek from comment #1)
> Started with r13-6945-g429a7a88438cc80e

I've run into this before.

_54 = _22  
is processed, and we cache _22 as a dependency fo _54.
then we do some propagation and rewrite this statement as 
_54 = 3

When we look at _54 later, it still shows the cached dependency as _22,  but
there is no longer a _22 in the IL.   

We are trapping because may_recompute_p is expecting the dependency to be up to
date.  The fix is to check if it is in the FREE_LIST or not as well.

Patch in testing.

diff --git a/gcc/gimple-range-gori.cc b/gcc/gimple-range-gori.cc
index 5f4313b27dd..2a575c006fc 100644
--- a/gcc/gimple-range-gori.cc
+++ b/gcc/gimple-range-gori.cc
@@ -1314,7 +1314,7 @@ gori_compute::may_recompute_p (tree name, basic_block bb,
int depth)
   tree dep2 = depend2 (name);

   // If the first dependency is not set, there is no recomputation.
-  if (!dep1)
+  if (!dep1 || SSA_NAME_IN_FREE_LIST (dep1))
     return false;

[Bug tree-optimization/109417] [13 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault since r13-6945

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109417

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Andrew Macleod <amacleod@gcc.gnu.org>:

https://gcc.gnu.org/g:7f056d5f4a0b9e29561d0375d5b4ad42c9f3f61e

commit r13-7113-g7f056d5f4a0b9e29561d0375d5b4ad42c9f3f61e
Author: Andrew MacLeod <amacleod@redhat.com>
Date:   Wed Apr 5 15:59:38 2023 -0400

    Check if dependency is valid before using in may_recompute_p.

    When the IL is rewritten after a statement has been processed and
    dependencies cached, its possible that an ssa-name in the dependency
    cache is no longer in the IL.  Check this before trying to recompute.

            PR tree-optimization/109417
            gcc/
            * gimple-range-gori.cc (gori_compute::may_recompute_p): Check if
            dependency is in SSA_NAME_FREE_LIST.

            gcc/testsuite/
            * gcc.dg/pr109417.c: New.

[Bug tree-optimization/109417] [13 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault since r13-6945

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109417

Andrew Macleod <amacleod at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Andrew Macleod <amacleod at redhat dot com> ---
fixed.

[Bug tree-optimization/109417] [13 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault since r13-6945

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109417

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Andrew Macleod <amacleod@gcc.gnu.org>:

https://gcc.gnu.org/g:40c7f943e882e8c5eccf45fc28146559f446764d

commit r14-271-g40c7f943e882e8c5eccf45fc28146559f446764d
Author: Andrew MacLeod <amacleod@redhat.com>
Date:   Tue Apr 25 15:33:52 2023 -0400

    Don't save ssa-name pointer in dependency cache.

    If the direct dependence fields point directly to an ssa-name,
    its possible that an optimization frees an ssa-name, and the value
    pointed to may now be in the free list.   Simply maintain the ssa
    version number instead.

            PR tree-optimization/109417
            * gimple-range-gori.cc (range_def_chain::register_dependency):
            Save the ssa version number, not the pointer.
            (gori_compute::may_recompute_p): No need to check if a dependency
            is in the free list.
            * gimple-range-gori.h (class range_def_chain): Change ssa1 and ssa2
            fields to be unsigned int instead of trees.
            (ange_def_chain::depend1): Adjust.
            (ange_def_chain::depend2): Adjust.
            * gimple-range.h: Include "ssa.h" to inline ssa_name().