[Bug tree-optimization/111917] New: ICE in as_a, at is-a.h:255 since GCC-8

[Bug tree-optimization/111917] New: ICE in as_a, at is-a.h:255 since GCC-8

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

            Bug ID: 111917
           Summary: ICE in as_a, at is-a.h:255 since GCC-8
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shaohua.li at inf dot ethz.ch
  Target Milestone: ---

gcc at -O3 crashed.

I didn't bisect this case because it affected even gcc-8.

Compiler explorer: https://godbolt.org/z/7Mz9G6Kro

$ cat a.c
long a() {
  long b, c;
  for (; b; b++)
    c <<= 1;
  return c;
}
static int d() {
e:
f:
  for (; a();)
    ;
  goto f;
  return 0;
}
int main() { d(); }
$
$ gcc -O3 a.c
during GIMPLE pass: unswitch
a.c: In function 'int main()':
a,c:15:5: internal compiler error: in as_a, at is-a.h:255
   15 | int main() { d(); }
      |     ^~~~
0x26259de internal_error(char const*, ...)
        ???:0
0xaf830e fancy_abort(char const*, int, char const*)
        ???:0
0x15b8af2 number_of_iterations_exit(loop*, edge_def*, tree_niter_desc*, bool,
bool, basic_block_def**)
        ???:0
0x14fca28 number_of_latch_executions(loop*)
        ???:0
0x15ba69d estimate_numbers_of_iterations(loop*)
        ???:0
0x15bc037 estimated_loop_iterations(loop*,
generic_wide_int<widest_int_storage<131072> >*)
        ???:0
0x15bc067 estimated_loop_iterations_int(loop*)
        ???:0
0x15cf559 tree_ssa_unswitch_loops(function*)
        ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
$

[Bug tree-optimization/111917] [11/12/13/14 Regression] ICE in as_a, at is-a.h:255 since GCC-8

[tkoenig at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

Thomas Koenig <tkoenig at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
            Summary|ICE in as_a, at is-a.h:255  |[11/12/13/14 Regression]
                   |since GCC-8                 |ICE in as_a, at is-a.h:255
                   |                            |since GCC-8
   Target Milestone|---                         |14.0
                 CC|                            |tkoenig at gcc dot gnu.org

--- Comment #1 from Thomas Koenig <tkoenig at gcc dot gnu.org> ---
Works for 4.8.5, must be a not-so-recent regression.

Note that with gcc (GCC) 11.3.1 20221121 (Red Hat 11.3.1-4) on POWER,
the error is different:

x.c: In function ‘main’:
x.c:15:5: internal compiler error: in mark_stmt_if_obviously_necessary, at
tree-ssa-dce.c:295
   15 | int main() { d(); }
      |     ^~~~
Please submit a full bug report,

[Bug tree-optimization/111917] [11/12/13/14 Regression] ICE in as_a, at is-a.h:255 since GCC-8

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-bisection
   Target Milestone|14.0                        |11.5
             Status|UNCONFIRMED                 |NEW
      Known to work|                            |6.4.0
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-10-22

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed. Dates to between 6 and 7.

[Bug tree-optimization/111917] [11/12/13/14 Regression] ICE in as_a, at is-a.h:255 since GCC-7

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
If someone is worried about uninitialized variables or an executed infinite
loop, this also ICEs at -O3:
```
long t;
long a() {
  long b = t, c = t;
  for (; b < 31; b++)
    c <<= 1;
  return c;
}
long long t1;
static 
int d() {
  if (!t1)
    return 0;
e:
f:
  for (; a();)
    ;
  goto f;
  return 0;
}
int main() { d(); }
```

[Bug tree-optimization/111917] [11/12/13/14 Regression] ICE in as_a, at is-a.h:255 since GCC-7

[tkoenig at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

--- Comment #4 from Thomas Koenig <tkoenig at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #3)
> If someone is worried about uninitialized variables or an executed infinite
> loop, this also ICEs at -O3:
> ```
> long t;
> long a() {
>   long b = t, c = t;
>   for (; b < 31; b++)
>     c <<= 1;
>   return c;
> }
> long long t1;
> static 
> int d() {
>   if (!t1)
>     return 0;
> e:
> f:
>   for (; a();)
>     ;
>   goto f;
>   return 0;
> }
> int main() { d(); }
> ```

It does not ICE with aa90195, for which the original test case ICEs,
so it is something else (although probably related).

[Bug tree-optimization/111917] [11/12/13/14 Regression] ICE in as_a, at is-a.h:255 since GCC-7

[tkoenig at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

--- Comment #5 from Thomas Koenig <tkoenig at gcc dot gnu.org> ---

> It does not ICE with aa90195, for which the original test case ICEs,
> so it is something else (although probably related).

.. or at least it does not ICE with checking disabled (to be exact).

[Bug tree-optimization/111917] [11/12/13/14 Regression] ICE in as_a, at is-a.h:255 since GCC-7

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
We have two outgoing edges for

<bb 3> [local count: 40157944]:
e:

and

<bb 15> [local count: 35740570]:
if (b_3 <= 30)
f:

before unswitching starts it looks OK, so we're splitting/inserting things
wrong there.  I'll have a look.

[Bug tree-optimization/111917] [11/12/13/14 Regression] ICE in as_a, at is-a.h:255 since GCC-7

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:d96bd4aade170fcd86f5f09b68b770dde798e631

commit r14-4857-gd96bd4aade170fcd86f5f09b68b770dde798e631
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Oct 23 11:25:17 2023 +0200

    tree-optimization/111917 - bougs IL after guard hoisting

    The unswitching code to hoist guards inserts conditions in wrong
    places.  The following fixes this, simplifying code.

            PR tree-optimization/111917
            * tree-ssa-loop-unswitch.cc (hoist_guard): Always insert
            new conditional after last stmt.

            * gcc.dg/torture/pr111917.c: New testcase.

[Bug tree-optimization/111917] [11/12/13 Regression] ICE in as_a, at is-a.h:255 since GCC-7

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[11/12/13/14 Regression]    |[11/12/13 Regression] ICE
                   |ICE in as_a, at is-a.h:255  |in as_a, at is-a.h:255
                   |since GCC-7                 |since GCC-7
      Known to work|                            |14.0
           Priority|P3                          |P2

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug tree-optimization/111917] [11/12/13 Regression] ICE in as_a, at is-a.h:255 since GCC-7

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:28d9e033a8e95c024e27cb495db610aac37a0f88

commit r13-8045-g28d9e033a8e95c024e27cb495db610aac37a0f88
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Oct 23 11:25:17 2023 +0200

    tree-optimization/111917 - bougs IL after guard hoisting

    The unswitching code to hoist guards inserts conditions in wrong
    places.  The following fixes this, simplifying code.

            PR tree-optimization/111917
            * tree-ssa-loop-unswitch.cc (hoist_guard): Always insert
            new conditional after last stmt.

            * gcc.dg/torture/pr111917.c: New testcase.

    (cherry picked from commit d96bd4aade170fcd86f5f09b68b770dde798e631)

[Bug tree-optimization/111917] [11/12 Regression] ICE in as_a, at is-a.h:255 since GCC-7

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

--- Comment #10 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:bbd68241f7277850ba9f97c3d26c968f365f5479

commit r12-10015-gbbd68241f7277850ba9f97c3d26c968f365f5479
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Oct 23 11:25:17 2023 +0200

    tree-optimization/111917 - bougs IL after guard hoisting

    The unswitching code to hoist guards inserts conditions in wrong
    places.  The following fixes this, simplifying code.

            PR tree-optimization/111917
            * tree-ssa-loop-unswitch.cc (hoist_guard): Always insert
            new conditional after last stmt.

            * gcc.dg/torture/pr111917.c: New testcase.

    (cherry picked from commit d96bd4aade170fcd86f5f09b68b770dde798e631)

[Bug tree-optimization/111917] [11 Regression] ICE in as_a, at is-a.h:255 since GCC-7

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

--- Comment #11 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ec8d0c33211c5e92c220483d6fe9f0a2391d2d6d

commit r11-11145-gec8d0c33211c5e92c220483d6fe9f0a2391d2d6d
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Oct 23 11:25:17 2023 +0200

    tree-optimization/111917 - bougs IL after guard hoisting

    The unswitching code to hoist guards inserts conditions in wrong
    places.  The following fixes this, simplifying code.

            PR tree-optimization/111917
            * tree-ssa-loop-unswitch.c (hoist_guard): Always insert
            new conditional after last stmt.

            * gcc.dg/torture/pr111917.c: New testcase.

    (cherry picked from commit d96bd4aade170fcd86f5f09b68b770dde798e631)

[Bug tree-optimization/111917] [11 Regression] ICE in as_a, at is-a.h:255 since GCC-7

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111917

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
      Known to work|                            |11.4.1
      Known to fail|                            |11.4.0

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.