[Bug c/110298] New: ICE at -Os on x86_64-linux-gnu

[Bug c/110298] New: ICE at -Os on x86_64-linux-gnu

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

            Bug ID: 110298
           Summary: ICE at -Os on x86_64-linux-gnu
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shaohua.li at inf dot ethz.ch
  Target Milestone: ---

ICE at -Os.

$ cat a.c
int a, b, c, d, e;
int f() {
  c = 0;
  for (; c >= 0; c--) {
    d = 0;
    for (; d <= 0; d++) {
      e = 0;
      for (; d + c + e >= 0; e--)
        ;
      a = 1;
      b = 0;
      for (; a; ++b)
        a *= 2;
      for (; b + d >= 0;)
        return 0;
    }
  }
}
int main() {}
$
$ gcc-tk -Os a.c
during GIMPLE pass: cunroll
a.c: In function ‘f’:
a.c:2:5: internal compiler error: tree check: expected class ‘type’, have
‘exceptional’ (error_mark) in tree_nop_conversion_p, at tree.cc:11961
    2 | int f() {
      |     ^
0x20cb70e internal_error(char const*, ...)
        ???:0
0x87f9b6 tree_class_check_failed(tree_node const*, tree_code_class, char
const*, int, char const*)
        ???:0
0x16e265d generic_simplify_386(unsigned int, tree_node*, tree_node*,
tree_node*, tree_node**, tree_code)
        ???:0
0x16b8bc8 generic_simplify_GE_EXPR(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*)
        ???:0
0xca5f45 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ???:0
0xcc0dc4 fold(tree_node*)
        ???:0
0x1209be8 simplify_replace_tree(tree_node*, tree_node*, tree_node*, tree_node*
(*)(tree_node*, void*), void*, bool)
        ???:0
0x120abcb substitute_in_loop_info(loop*, tree_node*, tree_node*)
        ???:0
0x10c6dc5 replace_uses_by(tree_node*, tree_node*)
        ???:0
0xb485d3 merge_blocks(basic_block_def*, basic_block_def*)
        ???:0
0x10d9784 cleanup_tree_cfg(unsigned int)
        ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
$
$ gcc-tk -v
Using built-in specs.
COLLECT_GCC=gcc-tk
COLLECT_LTO_WRAPPER=/zdata/shaoli/compilers/ccbuilder-compilers/gcc-27612ce352921d74086102d9ad4d3e011923f837/libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../configure --disable-multilib --disable-bootstrap
--enable-languages=c,c++
--prefix=/zdata/shaoli/compilers/ccbuilder-compilers/gcc-27612ce352921d74086102d9ad4d3e011923f837
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.0 20230616 (experimental) (GCC)
$

[Bug c/110298] [10/11/12/13/14 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
            Summary|ICE at -Os on               |[10/11/12/13/14 Regression]
                   |x86_64-linux-gnu            |ICE at -Os on
                   |                            |x86_64-linux-gnu since
                   |                            |r10-840
                 CC|                            |jakub at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
   Last reconfirmed|                            |2023-06-17
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r10-840-g5fd8a9cb5b0e95af7f833

[Bug tree-optimization/110298] [10/11/12/13/14 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |10.5
           Keywords|                            |ice-on-valid-code
          Component|c                           |tree-optimization

[Bug tree-optimization/110298] [10/11/12/13/14 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
loop->nb_iterations still includes reference to a removed SSA name ...

[Bug tree-optimization/110298] [10/11/12/13/14 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.  OK, so we unroll ("unloop") the middle-loop and the
recorded loop father now no longer covers the sub-loops.  We then end up
value-numbering a part of the CFG that has defs used for later loop
nb_iterations but value-numbering only substitutes into loop info of
loops in the region it processes.

Now, we free all nb_iterations but only after the CFG cleanup.  The simple
fix is to do that beforehand.

[Bug tree-optimization/110298] [10/11/12/13/14 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:916add3bf6e46467e4391e358b11ecfbc4daa275

commit r14-1939-g916add3bf6e46467e4391e358b11ecfbc4daa275
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Jun 19 09:52:45 2023 +0200

    tree-optimization/110298 - CFG cleanup and stale nb_iterations

    When unrolling we eventually kill nb_iterations info since it may
    refer to removed SSA names.  But we do this only after cleaning
    up the CFG which in turn can end up accessing it.  Fixed by
    swapping the two.

            PR tree-optimization/110298
            * tree-ssa-loop-ivcanon.cc (tree_unroll_loops_completely):
            Clear number of iterations info before cleaning up the CFG.

            * gcc.dg/torture/pr110298.c: New testcase.

[Bug tree-optimization/110298] [10/11/12/13 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |14.0
            Summary|[10/11/12/13/14 Regression] |[10/11/12/13 Regression]
                   |ICE at -Os on               |ICE at -Os on
                   |x86_64-linux-gnu since      |x86_64-linux-gnu since
                   |r10-840                     |r10-840
           Priority|P3                          |P2
      Known to fail|                            |13.1.0

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug tree-optimization/110298] [10/11/12/13 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:9da2ef362fa8dc54df26c704a38dda40baee3ce9

commit r13-7469-g9da2ef362fa8dc54df26c704a38dda40baee3ce9
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Jun 19 09:52:45 2023 +0200

    tree-optimization/110298 - CFG cleanup and stale nb_iterations

    When unrolling we eventually kill nb_iterations info since it may
    refer to removed SSA names.  But we do this only after cleaning
    up the CFG which in turn can end up accessing it.  Fixed by
    swapping the two.

            PR tree-optimization/110298
            * tree-ssa-loop-ivcanon.cc (tree_unroll_loops_completely):
            Clear number of iterations info before cleaning up the CFG.

            * gcc.dg/torture/pr110298.c: New testcase.

    (cherry picked from commit 916add3bf6e46467e4391e358b11ecfbc4daa275)

[Bug tree-optimization/110298] [10/11/12 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:c409f2a1cc5d5bffe2fb93454924ae402c57f8f6

commit r12-9723-gc409f2a1cc5d5bffe2fb93454924ae402c57f8f6
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Jun 19 09:52:45 2023 +0200

    tree-optimization/110298 - CFG cleanup and stale nb_iterations

    When unrolling we eventually kill nb_iterations info since it may
    refer to removed SSA names.  But we do this only after cleaning
    up the CFG which in turn can end up accessing it.  Fixed by
    swapping the two.

            PR tree-optimization/110298
            * tree-ssa-loop-ivcanon.cc (tree_unroll_loops_completely):
            Clear number of iterations info before cleaning up the CFG.

            * gcc.dg/torture/pr110298.c: New testcase.

    (cherry picked from commit 916add3bf6e46467e4391e358b11ecfbc4daa275)

[Bug tree-optimization/110298] [11 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.

[Bug tree-optimization/110298] [11 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:0e332ee568739448a9439c7074d2a29badba60f2

commit r11-11141-g0e332ee568739448a9439c7074d2a29badba60f2
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Jun 19 09:52:45 2023 +0200

    tree-optimization/110298 - CFG cleanup and stale nb_iterations

    When unrolling we eventually kill nb_iterations info since it may
    refer to removed SSA names.  But we do this only after cleaning
    up the CFG which in turn can end up accessing it.  Fixed by
    swapping the two.

            PR tree-optimization/110298
            * tree-ssa-loop-ivcanon.c (tree_unroll_loops_completely):
            Clear number of iterations info before cleaning up the CFG.

            * gcc.dg/torture/pr110298.c: New testcase.

    (cherry picked from commit 916add3bf6e46467e4391e358b11ecfbc4daa275)

[Bug tree-optimization/110298] [11 Regression] ICE at -Os on x86_64-linux-gnu since r10-840

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110298

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED
      Known to fail|                            |11.4.0
      Known to work|                            |11.4.1

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.