[Bug tree-optimization/109524] New: [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[Bug tree-optimization/109524] New: [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

            Bug ID: 109524
           Summary: [13 Regression] ICE: SIGSEGV in
                    remove_unreachable::remove_and_update_globals
                    (tree-vrp.cc:136) with -O3 -fno-tree-forwprop
                    -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 54867
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54867&action=edit
auto-reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc -O3 -fno-tree-forwprop -fnon-call-exceptions
-fno-tree-ccp -fno-tree-fre testcase.C -w -wrapper
valgrind,-q,--track-origins=yes
==2129== Invalid read of size 8
==2129==    at 0x197A872: remove_unreachable::remove_and_update_globals(bool)
[clone .part.0] (tree-vrp.cc:136)
==2129==    by 0x197CC3D: remove_and_update_globals (tree-vrp.cc:1106)
==2129==    by 0x197CC3D: execute_ranger_vrp(function*, bool, bool)
(tree-vrp.cc:1104)
==2129==    by 0x15B4E8A: execute_one_pass(opt_pass*) (passes.cc:2651)
==2129==    by 0x15B577F: execute_pass_list_1(opt_pass*) (passes.cc:2760)
==2129==    by 0x15B5791: execute_pass_list_1(opt_pass*) (passes.cc:2761)
==2129==    by 0x15B57B8: execute_pass_list(function*, opt_pass*)
(passes.cc:2771)
==2129==    by 0x11E5605: expand (cgraphunit.cc:1841)
==2129==    by 0x11E5605: cgraph_node::expand() (cgraphunit.cc:1794)
==2129==    by 0x11E694A: expand_all_functions (cgraphunit.cc:2024)
==2129==    by 0x11E694A: symbol_table::compile() [clone .part.0]
(cgraphunit.cc:2398)
==2129==    by 0x11E94A7: compile (cgraphunit.cc:2311)
==2129==    by 0x11E94A7: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2583)
==2129==    by 0x16B5541: compile_file() (toplev.cc:471)
==2129==    by 0xE11068: do_compile (toplev.cc:2125)
==2129==    by 0xE11068: toplev::main(int, char**) (toplev.cc:2277)
==2129==    by 0xE12D0A: main (main.cc:39)
==2129==  Address 0x55a4840 is in a rw- anonymous segment
==2129== 
==2129== Invalid read of size 1
==2129==    at 0x197A876: remove_unreachable::remove_and_update_globals(bool)
[clone .part.0] (tree-vrp.cc:136)
==2129==    by 0x58E1A47: ???
==2129==    by 0x197CC3D: remove_and_update_globals (tree-vrp.cc:1106)
==2129==    by 0x197CC3D: execute_ranger_vrp(function*, bool, bool)
(tree-vrp.cc:1104)
==2129==    by 0x15B4E8A: execute_one_pass(opt_pass*) (passes.cc:2651)
==2129==    by 0x15B577F: execute_pass_list_1(opt_pass*) (passes.cc:2760)
==2129==    by 0x15B5791: execute_pass_list_1(opt_pass*) (passes.cc:2761)
==2129==    by 0x15B57B8: execute_pass_list(function*, opt_pass*)
(passes.cc:2771)
==2129==    by 0x11E5605: expand (cgraphunit.cc:1841)
==2129==    by 0x11E5605: cgraph_node::expand() (cgraphunit.cc:1794)
==2129==    by 0x11E694A: expand_all_functions (cgraphunit.cc:2024)
==2129==    by 0x11E694A: symbol_table::compile() [clone .part.0]
(cgraphunit.cc:2398)
==2129==    by 0x11E94A7: compile (cgraphunit.cc:2311)
==2129==    by 0x11E94A7: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2583)
==2129==    by 0x16B5541: compile_file() (toplev.cc:471)
==2129==    by 0xE11068: do_compile (toplev.cc:2125)
==2129==    by 0xE11068: toplev::main(int, char**) (toplev.cc:2277)
==2129==  Address 0xa5a5a5a5a5a5a5f6 is not stack'd, malloc'd or (recently)
free'd
==2129== 
during GIMPLE pass: vrp
testcase.C: In function 'void AddGRFTextToList()':
testcase.C:30:6: internal compiler error: Segmentation fault
   30 | void AddGRFTextToList() {
      |      ^~~~~~~~~~~~~~~~
0x16b507f crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:314
0x197a876 remove_unreachable::remove_and_update_globals(bool)
        /repo/gcc-trunk/gcc/tree-vrp.cc:136
...

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r13-7181-20230414111512-gb0e85485fbf-checking-yes-rtl-df-extra-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/13.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--with-cloog --with-ppl --with-isl --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=x86_64-pc-linux-gnu
--with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r13-7181-20230414111512-gb0e85485fbf-checking-yes-rtl-df-extra-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 13.0.1 20230414 (experimental) (GCC)

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Created attachment 54869
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54869&action=edit
Further reduced

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-04-15
             Status|UNCONFIRMED                 |NEW

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com,
                   |                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r13-3596-ge7310e24b1c0ca67b1bb

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #3)
> Started with r13-3596-ge7310e24b1c0ca67b1bb

You might want to add -param=vrp1-mode=ranger when bisecting.

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
That only moves it by a single revision back - r13-3595-g7b1cdca6d6d594a

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #5)
> That only moves it by a single revision back - r13-3595-g7b1cdca6d6d594a

Which actually makes sense as the most reduced testcase has
__builtin_unreachable in it. I am not sure if the original non-reduced testcase
(which was not attached here had a function which returned without a return
value or not).

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
The edge in question has been removed in
#2  0x00000000025b0e32 in free_edge (fn=0x7fffea2ed7e8, e=<error reading
variable: Cannot access memory at address 0xa5a5a5a5a5a5a5f9>) at
../../gcc/cfg.cc:93
#3  0x00000000025b1631 in remove_edge_raw (e=<error reading variable: Cannot
access memory at address 0xa5a5a5a5a5a5a5f9>) at ../../gcc/cfg.cc:367
#4  0x00000000009e447c in remove_edge (e=<error reading variable: Cannot access
memory at address 0xa5a5a5a5a5a5a5f9>) at ../../gcc/cfghooks.cc:464
#5  0x00000000009e49b5 in delete_basic_block (bb=<basic_block 0x7fffea30c240
(8)>) at ../../gcc/cfghooks.cc:636
#6  0x000000000112b193 in remove_edge_and_dominated_blocks (e=<edge
0x7fffea30b600 (3 -> 6)>) at ../../gcc/tree-cfg.cc:8958
#7  0x000000000112b34f in gimple_purge_dead_eh_edges (bb=<basic_block
0x7fffea2dbea0 (3)>) at ../../gcc/tree-cfg.cc:9002
#8  0x000000000112b412 in gimple_purge_all_dead_eh_edges (blocks=0x39d0cb8) at
../../gcc/tree-cfg.cc:9029
#9  0x000000000131281a in substitute_and_fold_engine::substitute_and_fold
(this=0x7fffffffd960, block=<basic_block 0x0>) at
../../gcc/tree-ssa-propagate.cc:998
#10 0x000000000145ef6b in execute_ranger_vrp (fun=0x7fffea2ed7e8,
warn_array_bounds_p=true, final_p=false) at ../../gcc/tree-vrp.cc:1102
and
#0  0x00000000009d9c1b in bb_seq_addr (bb=<error reading variable: Cannot
access memory at address 0xa5a5a5a5a5a5a5f9>) at ../../gcc/gimple.h:1820
#1  0x00000000009f7325 in gsi_last_bb (bb=<error reading variable: Cannot
access memory at address 0xa5a5a5a5a5a5a5f9>) at
../../gcc/gimple-iterator.h:160
#2  0x0000000000c7fe17 in gsi_last_nondebug_bb (bb=<error reading variable:
Cannot access memory at address 0xa5a5a5a5a5a5a5f9>) at
../../gcc/gimple-iterator.h:321
#3  0x000000000265dca9 in gimple_outgoing_range_stmt_p (bb=<error reading
variable: Cannot access memory at address 0xa5a5a5a5a5a5a5f9>) at
../../gcc/gimple-range-edge.cc:42
#4  0x000000000145b54d in remove_unreachable::remove_and_update_globals
(this=0x7fffffffd970, final_p=false) at ../../gcc/tree-vrp.cc:136
#5  0x000000000145ef87 in execute_ranger_vrp (fun=0x7fffea2ed7e8,
warn_array_bounds_p=true, final_p=false) at ../../gcc/tree-vrp.cc:1104
then tries to access the already freed edge which was kept in some list of
edges across the gimple_purge_all_dead_eh_edges.

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Perhaps add to substitute_and_fold another callback before the dead eh edges
etc. are removed and perform this m_unreachable.remove_and_update_globals in
there rather than after substitute_and_fold returns?

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
I'm testing a simple patch^Whack.

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:f66ae49bba7d3b8c999498a0e166c0a2f99ec61a

commit r13-7203-gf66ae49bba7d3b8c999498a0e166c0a2f99ec61a
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Apr 17 09:22:57 2023 +0200

    tree-optimization/109524 - ICE with VRP edge removal

    VRP queues edges to process late for updating global ranges for
    __builtin_unreachable.  But this interferes with edge removal
    from substitute_and_fold.  The following deals with this by
    looking up the edge with source/dest block indices which do not
    become stale.

            PR tree-optimization/109524
            * tree-vrp.cc (remove_unreachable::m_list): Change to a
            vector of pairs of block indices.
            (remove_unreachable::maybe_register_block): Adjust.
            (remove_unreachable::remove_and_update_globals): Likewise.
            Deal with removed blocks.

            * g++.dg/pr109524.C: New testcase.

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

--- Comment #12 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:794ffdb0fb6312ce07af0bfc797bef9f4cff4c61

commit r14-59-g794ffdb0fb6312ce07af0bfc797bef9f4cff4c61
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Apr 19 10:01:04 2023 +0200

    testsuite: Fix up pr109524.C for -std=c++23 [PR109524]

    This testcase was reduced such that it isn't valid C++23, so with my
    usual testing with GXX_TESTSUITE_STDS=98,11,14,17,20,2b it fails:
    FAIL: g++.dg/pr109524.C  -std=gnu++2b (test for excess errors)
    .../gcc/testsuite/g++.dg/pr109524.C: In function 'nn hh(nn)':
    .../gcc/testsuite/g++.dg/pr109524.C:35:12: error: cannot bind non-const
lvalue reference of type 'nn&' to an rvalue of type 'nn'
    .../gcc/testsuite/g++.dg/pr109524.C:17:6: note:   initializing argument 1
of 'nn::nn(nn&)'
    The following patch fixes that and I've verified it doesn't change
    anything on what the test was testing, it still ICEs in r13-7198 and
    passes in r13-7203, now in all language modes (except for 98 where
    it is intentionally UNSUPPORTED).

    2023-04-19  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/109524
            * g++.dg/pr109524.C (nn::nn): Change argument type from nn & to
            const nn &.

[Bug tree-optimization/109524] [13 Regression] ICE: SIGSEGV in remove_unreachable::remove_and_update_globals (tree-vrp.cc:136) with -O3 -fno-tree-forwprop -fnon-call-exceptions -fno-tree-ccp -fno-tree-fre

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109524

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:865d712a9a20eed444ce61a0a0106534479bedf1

commit r13-7224-g865d712a9a20eed444ce61a0a0106534479bedf1
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Apr 19 10:01:04 2023 +0200

    testsuite: Fix up pr109524.C for -std=c++23 [PR109524]

    This testcase was reduced such that it isn't valid C++23, so with my
    usual testing with GXX_TESTSUITE_STDS=98,11,14,17,20,2b it fails:
    FAIL: g++.dg/pr109524.C  -std=gnu++2b (test for excess errors)
    .../gcc/testsuite/g++.dg/pr109524.C: In function 'nn hh(nn)':
    .../gcc/testsuite/g++.dg/pr109524.C:35:12: error: cannot bind non-const
lvalue reference of type 'nn&' to an rvalue of type 'nn'
    .../gcc/testsuite/g++.dg/pr109524.C:17:6: note:   initializing argument 1
of 'nn::nn(nn&)'
    The following patch fixes that and I've verified it doesn't change
    anything on what the test was testing, it still ICEs in r13-7198 and
    passes in r13-7203, now in all language modes (except for 98 where
    it is intentionally UNSUPPORTED).

    2023-04-19  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/109524
            * g++.dg/pr109524.C (nn::nn): Change argument type from nn & to
            const nn &.

    (cherry picked from commit 794ffdb0fb6312ce07af0bfc797bef9f4cff4c61)