[Bug sanitizer/109594] New: [14 Regression] ICE verify_gimple failed since r14-67-g2c800ed8d59cff with ASAN

[Bug sanitizer/109594] New: [14 Regression] ICE verify_gimple failed since r14-67-g2c800ed8d59cff with ASAN

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109594

            Bug ID: 109594
           Summary: [14 Regression] ICE verify_gimple failed since
                    r14-67-g2c800ed8d59cff with ASAN
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org,
                    marxin at gcc dot gnu.org, rguenth at gcc dot gnu.org
  Target Milestone: ---

The following newly causes an ICE:

$ gcc /home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/pr70022.c -O2
-fsanitize=address
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/pr70022.c: In function ‘foo’:
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/pr70022.c:7:1: error:
conversion of ‘ssa_name’ on the left hand side of ‘view_convert_expr’
    7 | foo (v4si v)
      | ^~~
VIEW_CONVERT_EXPR<int[4]>(v_1(D));

_4 = &VIEW_CONVERT_EXPR<int[4]>(v_1(D))[18446744073709551615];
during GIMPLE pass: asan
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/pr70022.c:7:1: internal
compiler error: verify_gimple failed
0x1ea6114 diagnostic_impl(rich_location*, diagnostic_metadata const*, int, char
const*, __va_list_tag (*) [1], diagnostic_t)
        ???:0
0x1ea6d66 internal_error(char const*, ...)
        ???:0
0xf3244d verify_gimple_in_cfg(function*, bool, bool)
        ???:0
0xdfb8e0 execute_function_todo(function*, void*)
        ???:0
0xdfbe4e execute_todo(unsigned int)
        ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
Simplify gimple_assign_load

[Bug sanitizer/109594] [14 Regression] ICE verify_gimple failed with ASAN since r14-67-g2c800ed8d59cff

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109594

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0
   Last reconfirmed|                            |2023-04-24
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.

[Bug sanitizer/109594] [14 Regression] ICE verify_gimple failed with ASAN since r14-67-g2c800ed8d59cff

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109594

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
This goes wrong in update_address_taken before into-SSA which removes
TREE_ADDRESSABLE from 'v' without transforming it in any way.

<bb 2> :
D.3193 = VIEW_CONVERT_EXPR<int[4]>(v)[18446744073709551615];
return D.3193;

update_address_taken uses maybe_rewrite_mem_ref_base to rewrite rvalues
but that leaves all outer handled components in place - in fact it
even puts a VIEW_CONVERT_EXPR around it.

For a "valid" testcase

typedef int v4si __attribute__((vector_size(16)));

int foo (v4si v)
{
  return v[1];
}

the frontend produces

  return VIEW_CONVERT_EXPR<int[4]>(v)[1];

and we then gimplify it to

  D.2755 = BIT_FIELD_REF <v, 32, 32>;

via folding the stmt and maybe_canonicalize_mem_ref_addr, but we refrain from
doing that for out-of-bound accesses.

We do not have good IL verification for the differences between valid GIMPLE
and valid GIMPLE SSA - verify_gimple_* verifies GIMPLE and verify_ssa
doesn't apply any additional IL constraints.

I think we do not want ARRAY_REF of SSA_NAMEs nor do we want multi-level
handled_components on SSA_NAMEs.

Either we have to be way more aggressive in rewriting the refs
(use get_ref_base_and_extent?) to BIT_FIELD_REFs or in this case to
in-bound refs or zero or we have to restrict the rewrite to the cases
we already handle (which is very few special cases around MEM_REF[&decl]).

I'm trying to see what doing the latter regresses.

[Bug sanitizer/109594] [14 Regression] ICE verify_gimple failed with ASAN since r14-67-g2c800ed8d59cff

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109594

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:7bcdcf86e8272eeb524cc1dcb0ada8c8cfe6f27e

commit r14-285-g7bcdcf86e8272eeb524cc1dcb0ada8c8cfe6f27e
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Apr 24 13:20:25 2023 +0200

    tree-optimization/109594 - wrong register promotion

    We fail to verify the constraints under which we allow handled
    components to wrap registers.  The gcc.dg/pr70022.c testcase shows
    that we happily end up with

      _2 = VIEW_CONVERT_EXPR<int[4]>(v_1(D))

    as produced by SSA rewrite and update_address_taken.  But the intent
    was that we wrap registers with at most a single level of handled
    components and specifically only allow __real, __imag, BIT_FIELD_REF
    and VIEW_CONVERT_EXPR on them, but not ARRAY_REF or COMPONENT_REF.

    Together with the improved gimple_load predicate taking advantage
    of the above and ASAN this eventually ICEd.

    The following fixes update_address_taken as to this constraint.

            PR tree-optimization/109594
            * tree-ssa.cc (non_rewritable_mem_ref_base): Constrain
            what we rewrite to a register based on the above.

[Bug sanitizer/109594] [14 Regression] ICE verify_gimple failed with ASAN since r14-67-g2c800ed8d59cff

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109594

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug sanitizer/109594] [14 Regression] ICE verify_gimple failed with ASAN since r14-67-g2c800ed8d59cff

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109594

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug sanitizer/109594] [14 Regression] ICE verify_gimple failed with ASAN since r14-67-g2c800ed8d59cff

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109594
Bug 109594 depends on bug 109607, which changed state.

Bug 109607 Summary: IPA replaces stmt with invalid gimple
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109607

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED