[Bug tree-optimization/111387] New: ICE on valid code at -O2 and -O3: verify_ssa failed

[Bug tree-optimization/111387] New: ICE on valid code at -O2 and -O3: verify_ssa failed

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111387

            Bug ID: 111387
           Summary: ICE on valid code at -O2 and -O3: verify_ssa failed
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

This appears to be a recent regression.

Compiler Explorer: https://godbolt.org/z/9v9T5bfz9

[517] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/home/suz/suz-local/software/local/gcc-trunk/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.0 20230912 (experimental) (GCC) 
[518] % 
[518] % gcctk -O2 small.c
small.c: In function ‘main’:
small.c:6:5: error: definition in block 5 does not dominate use in block 2
    6 | int main() {
      |     ^~~~
for SSA_NAME: l_23 in statement:
_4 = {0, l_23};
during GIMPLE pass: slp
small.c:6:5: internal compiler error: verify_ssa failed
0x126622d verify_ssa(bool, bool)
        ../../gcc-trunk/gcc/tree-ssa.cc:1203
0xee7085 execute_function_todo
        ../../gcc-trunk/gcc/passes.cc:2095
0xee74db execute_todo
        ../../gcc-trunk/gcc/passes.cc:2142
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[519] % 
[519] % cat small.c
struct {
  unsigned a;
  unsigned b;
} c;
int d, e, f, g, h;
int main() {
  if (c.b && g && g > 7)
    goto i;
 j:
  if (c.a) {
    int k = 0;
    unsigned l = c.b;
    if (0) {
    m:
      k = l = c.b;
    }
    c.a = k;
    c.b = l;
  }
  if (0) {
  i:
    goto m;
  }
  if (d)
    goto j;
  for (f = 5; f; f--)
    if (h)
      e = 0;
  return 0;
}

[Bug tree-optimization/111387] ICE on valid code at -O2 and -O3: verify_ssa failed

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111387

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
   Last reconfirmed|                            |2023-09-12
           Keywords|                            |ice-on-valid-code
            Version|unknown                     |14.0
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look, probably latent on the branch(es).  On 13 we have a
conversion in the way:

  <bb 7> [local count: 91268056]:
  # k_9 = PHI <0(6), k_17(4)>
  # l_10 = PHI <l_23(6), _1(4)>
  k.2_4 = (unsigned int) k_9;
  c.a = k.2_4;
  c.b = l_10;

[Bug tree-optimization/111387] ICE on valid code at -O2 and -O3: verify_ssa failed

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111387

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
The main issue is that when BB SLP splits the function when we already entered
a cycle we have to go back and split at the containing cycles (recursively)
because otherwise we can end up seeing "externals" from backedges.

This particular testcase can be fixed by iterating over blocks in a better
way but the general issue remains that the defensive code in
vect_get_and_check_slp_defs relies on dominance info which doesn't work well
for irreducible regions we are faced with here.

The testcase also shows the recent honoring of ->dont_vectorize pessimizes
the cases where we applied if-conversion for loop vectorization since that
sets ->dont_vectorize on the original loop and that never gets cleared.

[Bug tree-optimization/111387] ICE on valid code at -O2 and -O3: verify_ssa failed

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111387

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:04238615bba435f0b0ca7b263ad2c6bdb596e865

commit r14-3920-g04238615bba435f0b0ca7b263ad2c6bdb596e865
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Sep 13 11:04:31 2023 +0200

    tree-optimization/111387 - BB SLP and irreducible regions

    When we split an irreducible region for BB vectorization analysis
    the defensive handling of external backedge defs in
    vect_get_and_check_slp_defs doesn't work since that relies on
    dominance info to identify a backedge.  The testcase also shows
    we are iterating over the function in a sub-optimal way which is
    why we split the irreducible region in the first place.  The fix
    is to mark backedges and use EDGE_DFS_BACK to identify them and
    to use the region RPO compute which can produce a RPO order keeping
    cycles in a better order (and as side effect marks backedges).

            PR tree-optimization/111387
            * tree-vect-slp.cc (vect_get_and_check_slp_defs): Check
            EDGE_DFS_BACK when doing BB vectorization.
            (vect_slp_function): Use rev_post_order_and_mark_dfs_back_seme
            to compute RPO and mark backedges.

            * gcc.dg/torture/pr111387.c: New testcase.

[Bug tree-optimization/111387] ICE on valid code at -O2 and -O3: verify_ssa failed

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111387

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |14.0

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed for trunk.  The issue is latent but more difficult to trigger on the
branch(es), a change less likely to change code generation would be to
call mark_dfs_back_edges () and not change the iteration order.