[Bug c/111458] New: ICE in in dfs_enumerate_from, at cfganal.c:1560

[Bug c/111458] New: ICE in in dfs_enumerate_from, at cfganal.c:1560

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111458

            Bug ID: 111458
           Summary: ICE in in dfs_enumerate_from, at cfganal.c:1560
           Product: gcc
           Version: 11.4.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: 19373742 at buaa dot edu.cn
  Target Milestone: ---

Created attachment 55921
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55921&action=edit
The preprocessed file

*******************************************************************************
OS and Platform:
CentOS Linux release 7.9.2009 (Core), x86_64 GNU/Linux
*******************************************************************************
gcc version:

# gcc -v
Using built-in specs.
COLLECT_GCC=/home/gcc-releases/gcc-11-0914/bin/gcc
COLLECT_LTO_WRAPPER=/home/gcc-releases/gcc-11-0914/libexec/gcc/x86_64-pc-linux-gnu/11.4.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ./configure --prefix=/home/gcc-releases/gcc-11-0914/
--disable-multilib --enable-language=c,c++
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.4.1 20230914 (GCC) 

*******************************************************************************
Command Lines:
# /home/gcc-releases/gcc-11-0914/bin/gcc -I /home/csmith/include/csmith-2.3.0/
-O3 -fno-expensive-optimizations -fno-inline-small-functions -fno-ipa-sra
-fno-tree-ccp -fno-tree-dse -fno-tree-fre -fno-tree-loop-ivcanon a.c

a.c: In function ‘func_18’:
a.c:311:38: warning: conversion from ‘long unsigned int’ to ‘uint32_t’ {aka
‘unsigned int’} changes value from ‘18446744073709551607’ to ‘4294967287’
[-Woverflow]
  311 |                     uint32_t l_489 = 18446744073709551607UL;
      |                                      ^~~~~~~~~~~~~~~~~~~~~~
during GIMPLE pass: vrp
a.c: In function ‘func_1’:
a.c:42:17: internal compiler error: in dfs_enumerate_from, at cfganal.c:1560
   42 | static int16_t  func_1(void)
      |                 ^~~~~~
0x6402fd dfs_enumerate_from(basic_block_def*, int, bool (*)(basic_block_def
const*, void const*), basic_block_def**, int, void const*)
        ../.././gcc/cfganal.c:1560
0xd635c9 determine_bb_domination_status(loop*, basic_block_def*)
        ../.././gcc/tree-ssa-threadupdate.c:1594
0xd635c9 determine_bb_domination_status(loop*, basic_block_def*)
        ../.././gcc/tree-ssa-threadupdate.c:1559
0xd659e2 thread_through_loop_header
        ../.././gcc/tree-ssa-threadupdate.c:1741
0xd659e2 thread_through_all_blocks(bool)
        ../.././gcc/tree-ssa-threadupdate.c:2667
0xe04ef4 execute_vrp
        ../.././gcc/tree-vrp.c:4580
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug c/111458] ICE in in dfs_enumerate_from, at cfganal.c:1560

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111458

--- Comment #1 from CTC <19373742 at buaa dot edu.cn> ---
Created attachment 55922
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55922&action=edit
The compiler output

[Bug tree-optimization/111458] [11 Regression] ICE in in dfs_enumerate_from, at cfganal.c:1560

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111458

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |11.1.0, 11.4.0
           Keywords|                            |ice-on-valid-code
      Known to work|                            |10.1.0, 12.0
            Summary|ICE in in                   |[11 Regression] ICE in in
                   |dfs_enumerate_from, at      |dfs_enumerate_from, at
                   |cfganal.c:1560              |cfganal.c:1560
   Target Milestone|---                         |11.5

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Someone will need to check to see if this went latent in GCC 12.
THere has been many changes in GCC 12 dealing with VRP and jump threading that
this might have been fixed ...

[Bug tree-optimization/111458] [11 Regression] ICE in in dfs_enumerate_from, at cfganal.c:1560

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111458

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |law at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
   Last reconfirmed|                            |2023-09-19
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
The issue is that the loop structure is broken and thus asking for
determine_bb_domination_status and then

1594      nblocks = dfs_enumerate_from (loop->latch, 1,
dbds_continue_enumeration_p,
1595                                    bblocks, loop->num_nodes, bb);

doesn't work.  We are likely threading if (1 != 0) branches in weird ways.
The problem likely gone away by doing threading in a separate pass in GCC 12.

Calling determine_bb_domination_status after we have done any transforms
definitely looks dangerous - this should be done _before_ any CFG changes.
This issue is still latent in the forward threader.  The backward threader
calls this function from back_threader_profitability::profitable_path_p,
so before doing any CFG changes.  In GCC 12 and later the remaining forward
threader instances are all from DOM(?).

Reduced testcase for the GCC 11 branch:

func_1() {
  for (;;)
    if (func_2())
      safe_lshift_func_uint16_t_u_u();
}
func_2(p_3, p_4) {
  char l_870;
  p_4 = -2;
  for (; p_4; p_4 = p_4 + 1) {
    int l_888_0 = 5;
    l_870 = 0;
    for (; l_870 <= 0; l_870 += 1) {
      p_3 = 0;
      for (; p_3 >= 0; p_3 -= 1)
        if (l_888_0)
          break;
      if (l_888_0)
        break;
      l_888_0 &= 0;
    }
  }
  return p_3;
}

[Bug tree-optimization/111458] [11 Regression] ICE in in dfs_enumerate_from, at cfganal.c:1560

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111458

--- Comment #4 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #3)

> This issue is still latent in the forward threader.  The backward threader
> calls this function from back_threader_profitability::profitable_path_p,
> so before doing any CFG changes.  In GCC 12 and later the remaining forward
> threader instances are all from DOM(?).

Yes.  Remaining uses of the forward threader are all from DOM.

I'd like to remove the forward threader in the next release, but it requires
being absolutely sure ranger catches everything the scoped tables do,
especially the floating point stuff.