[Bug c/111043] New: ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[Bug c/111043] New: ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

            Bug ID: 111043
           Summary: ICE in adjust_loop_info_after_peeling, at
                    tree-ssa-loop-ivcanon.cc:1068
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shaohua.li at inf dot ethz.ch
                CC: jh at suse dot cz
  Target Milestone: ---

gcc crashes at -O2 on the following test case.

Bisected to r14-2675-gef28aadad6e, could be similar to bug 110769 and bug
110641, but the bisection points are different.

Compiler explorer: https://godbolt.org/z/Ghza4o7d4

$ cat a.c
int a, b, c, d;
short e;
int f() {
  a = 1;
  while (a) {
    c = b % a;
    b = a;
    a = c;
  }
  return b;
}
int g() {
  d = 0;
  for (; d <= 1; d++)
    e = 0;
  for (; f() + d - 3 + e; e = e + 8)
    ;
}
int main() {}
$
$ gcc-r14-2675-gef28aadad6e  -O2 a.c
during GIMPLE pass: ch_vect
a.c: In function ‘g’:
a.c:12:5: internal compiler error: in adjust_loop_info_after_peeling, at
tree-ssa-loop-ivcanon.cc:1068
   12 | int g() {
      |     ^
0x21789ce internal_error(char const*, ...)
        ???:0
0x9d3f84 fancy_abort(char const*, int, char const*)
        ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
$

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|ICE in                      |[14 regression] ICE in
                   |adjust_loop_info_after_peel |adjust_loop_info_after_peel
                   |ing, at                     |ing, at
                   |tree-ssa-loop-ivcanon.cc:10 |tree-ssa-loop-ivcanon.cc:10
                   |68                          |68
   Target Milestone|---                         |14.0

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

David Binderman <dcb314 at hotmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dcb314 at hotmail dot com

--- Comment #1 from David Binderman <dcb314 at hotmail dot com> ---
I see this one also.

ccg $ ~/gcc/results.20230720.asan.ubsan/bin/gcc -v 2>&1 | grep exp
gcc version 14.0.0 20230720 (experimental) (b2cfe5233e682fc0) 
ccg $ ~/gcc/results.20230721.asan.ubsan/bin/gcc -v 2>&1 | grep exp
gcc version 14.0.0 20230721 (experimental) (f32518726ee8e836) 
ccg $ for i in ~/gcc/results.20230721.asan.ubsan/bin/gcc; do echo $i; $i -c -w
-O2 destDir/testFile.1328.c 2>&1 | grep error: ; done
/home/dcb38/gcc/results.20230721.asan.ubsan/bin/gcc
destDir/testFile.1328.c:41:9: internal compiler error: in
adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1023
ccg $ for i in ~/gcc/results.20230720.asan.ubsan/bin/gcc; do echo $i; $i -c -w
-O2 destDir/testFile.1328.c 2>&1 | grep error: ; done
/home/dcb38/gcc/results.20230720.asan.ubsan/bin/gcc
ccg $

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

--- Comment #2 from David Binderman <dcb314 at hotmail dot com> ---
Reduced code is

i_1;
*func_14_ptr_4;
short func_14_s_8;
func_14() {
  int i_2;
  int *ptr_6 = &i_1;
  *ptr_6 = 8;
  for (; *ptr_6 <= 9; *ptr_6 += 1)
    i_2 = *ptr_6;
  func_14_s_8 = 1;
  for (; func_14_s_8 <= 9;) {
    func_14_s_8 += i_2;
    *func_14_ptr_4 %= i_1;
  }
}

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

--- Comment #3 from David Binderman <dcb314 at hotmail dot com> ---
I have a bisection running. Current range is g:23ad5ed7432bea7c ..
g:85a4e4f93ff251f2,
some 8 commits.

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

--- Comment #4 from David Binderman <dcb314 at hotmail dot com> ---
$ git bisect bad ef28aadad6e5cff3
ef28aadad6e5cff3d7494f3c97d435a6579a2e2d is the first bad commit
commit ef28aadad6e5cff3d7494f3c97d435a6579a2e2d
Author: Jan Hubicka <jh@suse.cz>
Date:   Thu Jul 20 15:41:39 2023 +0200

    loop-ch improvements, part 3

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-08-20
     Ever confirmed|0                           |1

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed. In both cases copying the loop header gets rid of the loop which now
hits the unreachable.


In the first case before ch_vect we have:
```
  <bb 2> [local count: 118111600]:
  e = 0;
  d = 2;
  goto <bb 6>; [100.00%]

  <bb 5> [local count: 955630224]:
  e.8_3 = (unsigned short) e_lsm.21_6;
  _4 = e.8_3 + 8;
  _5 = (short int) _4;

  <bb 6> [local count: 1073741824]:
  # e_lsm.21_6 = PHI <0(2), _5(5)>
  # e_lsm_flag.22_41 = PHI <0(2), 1(5)>
  _11 = (int) e_lsm.21_6;
  _12 = _11;
  if (_12 != 0)
    goto <bb 5>; [89.00%]
  else
    goto <bb 7>; [11.00%]
```

And ch_vect goes and copies bb6 for bb2 and things go down hill from there.

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

Zhendong Su <zhendong.su at inf dot ethz.ch> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |zhendong.su at inf dot ethz.ch

--- Comment #6 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Another reproducer at -O3.

Compiler Explorer: https://godbolt.org/z/GYWG1G47K

[576] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/home/suz/suz-local/software/local/gcc-trunk/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.0 20230902 (experimental) (GCC) 
[577] % 
[577] % gcctk -O3 small.c
during GIMPLE pass: ch_vect
small.c: In function ‘main’:
small.c:3:5: internal compiler error: in adjust_loop_info_after_peeling, at
tree-ssa-loop-ivcanon.cc:1068
    3 | int main() {
      |     ^~~~
0x8299be adjust_loop_info_after_peeling(loop*, int, bool)
        ../../gcc-trunk/gcc/tree-ssa-loop-ivcanon.cc:1068
0x1154a33 copy_headers
        ../../gcc-trunk/gcc/tree-ssa-loop-ch.cc:1108
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[578] % cat small.c
int a = 1, b;
unsigned c = 2;
int main() {
  while (a >= c)
    ;
  while (a && b)
    ;
  while (!a || a >= c)
    c++;
  return 0;
}

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

--- Comment #7 from David Binderman <dcb314 at hotmail dot com> ---
A third reproducer, with -O3 required:

long g_18;
int g_170, g_759, g_1114;
extern void safe_lshift_func_uint64_t_u_u();
void func_35() {
  int __trans_tmp_1;
  for (; g_759 >= 0; g_759 = g_759 - (long)7) {
    g_170 = 0;
    if (__trans_tmp_1)
      return;
    if (g_1114)
      safe_lshift_func_uint64_t_u_u();
  }
}
void func_20() {
  int __trans_tmp_2;
  g_18 = 7;
  for (; g_18 >= 0; g_18 -= 1)
    __attribute__(()) int right = g_18;
  __trans_tmp_2 = right < 0 || right >= 2 ?: right;
  if (__trans_tmp_2)
    for (;;)
      ;
  func_35();
}

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org
           Priority|P3                          |P1

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Honza - this shows up frequently.

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

--- Comment #9 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Another at -O2 and -O3:

[545] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.0 20231101 (experimental) (GCC) 
[546] % 
[546] % gcctk -O2 small.c
during GIMPLE pass: ch_vect
small.c: In function ‘main’:
small.c:21:5: internal compiler error: in adjust_loop_info_after_peeling, at
tree-ssa-loop-ivcanon.cc:1069
   21 | int main() {
      |     ^~~~
0x8736bd adjust_loop_info_after_peeling(loop*, int, bool)
        ../../gcc-trunk/gcc/tree-ssa-loop-ivcanon.cc:1069
0x1287a14 copy_headers
        ../../gcc-trunk/gcc/tree-ssa-loop-ch.cc:1108
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[547] % 
[547] % cat small.c
int a, *b, c, *d, e, f;
static void g() {
  int h;
    while (1)
      while (1) {
        int *i = 0;
        h = 0;
        while (c)
          *d = 1;
        if (e)
          break;
        if ((h ^ f) > f)
          for (; e < 1; e++)
            ;
        for (a = 0; a < 1; a++)
          if (*i)
            break;
        b = &h;
      }
}
int main() {
  if (a)
    g();
  return 0;
}

[Bug tree-optimization/111043] [14 regression] ICE in adjust_loop_info_after_peeling, at tree-ssa-loop-ivcanon.cc:1068 since r14-2675-gef28aadad6e5cf

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111043

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed by r14-7138-g05e8ef2a05b477