[Bug tree-optimization/111571] New: [13/14 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[Bug tree-optimization/111571] New: [13/14 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

            Bug ID: 111571
           Summary: [13/14 Regression] ICE in modify_call, at
                    ipa-param-manipulation.cc:656
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shaohua.li at inf dot ethz.ch
                CC: mjambor at suse dot cz
  Target Milestone: ---

gcc at -O2 crashes on the following testcase.

Bisected to r13-4685-g4834e9360f7

Compiler explorer: https://godbolt.org/z/3b9ra7Kf8

$ cat a.c
struct a {
  int b;
};
struct c {
  long d;
  struct a e;
  long f;
};
int g, h, i;
int j() {return 0;}
static void k(struct a l, int p) {
  if (h)
    g = 0;
  for (; g; g = j())
    if (l.b)
      break;
}
static void m(struct c l) {
  k(l.e, l.f);
  for (;; --i)
    ;
}
int main() {
  struct c n = {10, 9};
  m(n);
}
$
$ gcc -O2 a.c
during IPA pass: inline
a.c: In function ‘main’:
a.c:25:9: internal compiler error: in modify_call, at
ipa-param-manipulation.cc:655
   25 |         m(n);
      |         ^~~~
0x7f9be5bb7082 __libc_start_main
        ../csu/libc-start.c:308
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
$

[Bug tree-optimization/111571] [13/14 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-09-24
           Assignee|unassigned at gcc dot gnu.org      |jamborm at gcc dot gnu.org
                 CC|                            |jamborm at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1

--- Comment #1 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Clearly mine.

[Bug ipa/111571] [13/14 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
   Target Milestone|---                         |13.3

[Bug ipa/111571] [13/14 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[noamlewis at google dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

Noam Lewis <noamlewis at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |noamlewis at google dot com

--- Comment #2 from Noam Lewis <noamlewis at google dot com> ---
Not sure if same bug or different, we encountered this:

gcc (Debian 13.2.0-4) 13.2.0

$ cat /tmp/example.c 
typedef struct {
} a;
struct b {
  short c
};
struct d e;
struct d {
  struct {
    struct b f
  }
} inline g(struct b h) {
  i();
  fn3();
  e.f = h;
  return e;
}
typedef struct {
  int n;
  int j;
  struct b k;
  a l
} m;
static o(m h) {
  p(h.n, h.l, 1);
  g(h.k);
}
q() {
  struct b r = {};
  o((m){.2, .1, r, {}});
}

$ gcc-13 /tmp/example.c -O2 -c  -w -freport-bug
during IPA pass: inline
/tmp/example.c: In function ‘q’:
/tmp/example.c:29:3: internal compiler error: in modify_call, at
ipa-param-manipulation.cc:656
   29 |   o((m){.2, .1, r, {}});
      |   ^~~~~~~~~~~~~~~~~~~~~
0x7fb9b73666c9 __libc_start_call_main
        ../sysdeps/nptl/libc_start_call_main.h:58
0x7fb9b7366784 __libc_start_main_impl
        ../csu/libc-start.c:360
Please submit a full bug report, with preprocessed source.
Please include the complete backtrace with any bug report.
See <file:///usr/share/doc/gcc-13/README.Bugs> for instructions.
The bug is not reproducible, so it is likely a hardware or OS problem.

[Bug ipa/111571] [13/14 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org
           Priority|P3                          |P1

[Bug ipa/111571] [13/14 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
           Priority|P1                          |P2

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 13.{1,2} has been released with this bug, so P2.

[Bug ipa/111571] [13/14 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

--- Comment #4 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I have proposed a fix on the mailing list:
https://inbox.sourceware.org/gcc-patches/ri6r0gbwf7l.fsf@virgil.suse.cz/T/#u

[Bug ipa/111571] [13/14 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

--- Comment #5 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Jambor <jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:ca56b43105fc09021ec445f1978a17cd85ae5e0c

commit r14-9794-gca56b43105fc09021ec445f1978a17cd85ae5e0c
Author: Martin Jambor <mjambor@suse.cz>
Date:   Thu Apr 4 22:46:16 2024 +0200

    ipa: Avoid duplicate replacements in IPA-SRA transformation phase

    When the analysis part of IPA-SRA figures out that it would split out
    a scalar part of an aggregate which is known by IPA-CP to contain a
    known constant, it skips it knowing that the transformation part looks
    at IPA-CP aggregate results too and does the right thing (which can
    include doing the propagation in GIMPLE because that is the last
    moment the parameter exists).

    However, when IPA-SRA wants to split out a smaller aggregate out
    of an aggregate, which happens to be of the same size as a known
    scalar constant at the same offset, the transformation bit fails to
    recognize the situation, tries to do both splitting and constant
    propagation and in PR 111571 testcase creates a nonsensical call
    statement on which the call redirection then ICEs.

    Fixed by making sure we don't try to do two replacements of the same
    part of the same parameter.

    The look-up among replacements requires these are sorted and this
    patch just sorts them if they are not already sorted before each new
    look-up.  The worst number of sortings that can happen is number of
    parameters which are both split and have aggregate constants times
    param_ipa_max_agg_items (default 16).  I don't think complicating the
    source code to optimize for this unlikely case is worth it but if need
    be, it can of course be done.

    gcc/ChangeLog:

    2024-03-15  Martin Jambor  <mjambor@suse.cz>

            PR ipa/111571
            * ipa-param-manipulation.cc
            (ipa_param_body_adjustments::common_initialization): Avoid creating
            duplicate replacement entries.

    gcc/testsuite/ChangeLog:

    2024-03-15  Martin Jambor  <mjambor@suse.cz>

            PR ipa/111571
            * gcc.dg/ipa/pr111571.c: New test.

[Bug ipa/111571] [13 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13/14 Regression] ICE in   |[13 Regression] ICE in
                   |modify_call, at             |modify_call, at
                   |ipa-param-manipulation.cc:6 |ipa-param-manipulation.cc:6
                   |56                          |56

--- Comment #6 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Fixed on master, fix queued for backporting to gcc 13 branch.

[Bug ipa/111571] [13 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

--- Comment #7 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Martin Jambor
<jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:8a3784adf5cd873ca295a5a011d8623338ff3976

commit r13-8619-g8a3784adf5cd873ca295a5a011d8623338ff3976
Author: Martin Jambor <mjambor@suse.cz>
Date:   Fri Apr 19 16:48:12 2024 +0200

    ipa: Avoid duplicate replacements in IPA-SRA transformation phase

    When the analysis part of IPA-SRA figures out that it would split out
    a scalar part of an aggregate which is known by IPA-CP to contain a
    known constant, it skips it knowing that the transformation part looks
    at IPA-CP aggregate results too and does the right thing (which can
    include doing the propagation in GIMPLE because that is the last
    moment the parameter exists).

    However, when IPA-SRA wants to split out a smaller aggregate out
    of an aggregate, which happens to be of the same size as a known
    scalar constant at the same offset, the transformation bit fails to
    recognize the situation, tries to do both splitting and constant
    propagation and in PR 111571 testcase creates a nonsensical call
    statement on which the call redirection then ICEs.

    Fixed by making sure we don't try to do two replacements of the same
    part of the same parameter.

    The look-up among replacements requires these are sorted and this
    patch just sorts them if they are not already sorted before each new
    look-up.  The worst number of sortings that can happen is number of
    parameters which are both split and have aggregate constants times
    param_ipa_max_agg_items (default 16).  I don't think complicating the
    source code to optimize for this unlikely case is worth it but if need
    be, it can of course be done.

    gcc/ChangeLog:

    2024-03-15  Martin Jambor  <mjambor@suse.cz>

            PR ipa/111571
            * ipa-param-manipulation.cc
            (ipa_param_body_adjustments::common_initialization): Avoid creating
            duplicate replacement entries.

    gcc/testsuite/ChangeLog:

    2024-03-15  Martin Jambor  <mjambor@suse.cz>

            PR ipa/111571
            * gcc.dg/ipa/pr111571.c: New test.

    (cherry picked from commit ca56b43105fc09021ec445f1978a17cd85ae5e0c)

[Bug ipa/111571] [13 Regression] ICE in modify_call, at ipa-param-manipulation.cc:656

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111571

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
      Known to work|                            |13.2.1
      Known to fail|                            |13.2.0
             Status|ASSIGNED                    |RESOLVED

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.