[Bug tree-optimization/111967] New: [12/13/14 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all

[Bug tree-optimization/111967] New: [12/13/14 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

            Bug ID: 111967
           Summary: [12/13/14 Regression] during GIMPLE pass: evrp ICE: in
                    operator[], at vec.h:910 with -O2 -fno-tree-forwprop
                    -fdump-tree-evrp-all
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 56193
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56193&action=edit
reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc -O2 -fno-tree-forwprop -fdump-tree-evrp-all
testcase.c
during GIMPLE pass: evrp
dump file: a-testcase.c.041t.evrp
testcase.c: In function 'Append':
testcase.c:12:1: internal compiler error: in operator[], at vec.h:910
   12 | }
      | ^
0xd68814 vec<edge_def*, va_gc, vl_embed>::operator[](unsigned int)
        /repo/gcc-trunk/gcc/vec.h:910
0xd68c11 vec<tree_node*, va_gc, vl_embed>::operator[](unsigned int)
        /repo/gcc-trunk/gcc/tree.h:3742
0xd68c11 block_range_cache::dump(_IO_FILE*, basic_block_def*, bool)
        /repo/gcc-trunk/gcc/gimple-range-cache.cc:490
0x256f97e ranger_cache::dump_bb(_IO_FILE*, basic_block_def*)
        /repo/gcc-trunk/gcc/gimple-range-cache.cc:1000
0x256ae12 gimple_ranger::dump_bb(_IO_FILE*, basic_block_def*)
        /repo/gcc-trunk/gcc/gimple-range.cc:630
0x256ba15 gimple_ranger::dump(_IO_FILE*)
        /repo/gcc-trunk/gcc/gimple-range.cc:706
0x17c7de8 execute_ranger_vrp(function*, bool, bool)
        /repo/gcc-trunk/gcc/tree-vrp.cc:1066
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r14-4893-20231024164508-g99a6c1065de-checking-yes-rtl-df-extra-nobootstrap-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--disable-bootstrap --with-cloog --with-ppl --with-isl
--build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu
--target=x86_64-pc-linux-gnu --with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r14-4893-20231024164508-g99a6c1065de-checking-yes-rtl-df-extra-nobootstrap-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.0 20231024 (experimental) (GCC)

[Bug tree-optimization/111967] [12/13/14 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.4

[Bug tree-optimization/111967] [12/13/14 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-10-24
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
      Known to work|                            |12.3.0, 13.2.0

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed. Can't reproduce it on the releases versions of GCC 12.3.0 and 13.2.0
either.

[Bug tree-optimization/111967] [12/13/14 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug tree-optimization/111967] [12/13/14 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all since r12-4694

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13/14 Regression]       |[12/13/14 Regression]
                   |during GIMPLE pass: evrp    |during GIMPLE pass: evrp
                   |ICE: in operator[], at      |ICE: in operator[], at
                   |vec.h:910 with -O2          |vec.h:910 with -O2
                   |-fno-tree-forwprop          |-fno-tree-forwprop
                   |-fdump-tree-evrp-all        |-fdump-tree-evrp-all since
                   |                            |r12-4694
           Priority|P1                          |P2
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r12-4694-gcb153222404e2e149aa65a4b3139b09477551203

[Bug tree-optimization/111967] [12/13/14 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all since r12-4694

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 56555
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56555&action=edit
gcc14-pr111967.patch

Untested fix.

[Bug tree-optimization/111967] [12/13/14 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all since r12-4694

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:5a0c302d2d721b9650c1e354695dbba87364c334

commit r14-5376-g5a0c302d2d721b9650c1e354695dbba87364c334
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Mon Nov 13 08:47:41 2023 +0100

    gimple-range-cache: Fix ICEs when dumping details [PR111967]

    The following testcase ICEs when dumping details.
    When m_ssa_ranges vector is created, it is safe_grow_cleared
(num_ssa_names),
    but when when some new SSA_NAME is added, we strangely grow it to
    num_ssa_names + 1 instead and later on the 3 argument dump method
    iterates from 1 to m_ssa_ranges.length () - 1 and uses ssa_name (x)
    on each; but because set_bb_range grew it one too much, ssa_name
    (m_ssa_ranges.length () - 1) might be after the end of the ssanames
    vector and ICE.

    The fix grows the vector consistently only to num_ssa_names,
    doesn't waste time checking m_ssa_ranges[0] because there is no
    ssa_names (0), it is always NULL, before using ssa_name (x) checks
    if we'll need it at all (we check later if m_ssa_ranges[x] is non-NULL,
    so we might check it earlier as well) and also in the last loop
    iterates until m_ssa_ranges.length () rather than num_ssa_names, I don't
    see a reason for the inconsistency and in theory some SSA_NAME could be
    added without set_bb_range called for it and the vector could be shorter
    than the ssanames vector.

    To actually fix the ICE, either the first hunk or the last 2 hunks
    would be enough, but I think it doesn't hurt to change all the spots.

    2023-11-13  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/111967
            * gimple-range-cache.cc (block_range_cache::set_bb_range): Grow
            m_ssa_ranges to num_ssa_names rather than num_ssa_names + 1.
            (block_range_cache::dump): Iterate from 1 rather than 0.  Don't use
            ssa_name (x) unless m_ssa_ranges[x] is non-NULL.  Iterate to
            m_ssa_ranges.length () rather than num_ssa_names.

            * gcc.dg/tree-ssa/pr111967.c: New test.

[Bug tree-optimization/111967] [12/13 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all since r12-4694

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13/14 Regression]       |[12/13 Regression] during
                   |during GIMPLE pass: evrp    |GIMPLE pass: evrp ICE: in
                   |ICE: in operator[], at      |operator[], at vec.h:910
                   |vec.h:910 with -O2          |with -O2 -fno-tree-forwprop
                   |-fno-tree-forwprop          |-fdump-tree-evrp-all since
                   |-fdump-tree-evrp-all since  |r12-4694
                   |r12-4694                    |

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed on the trunk for now.

[Bug tree-optimization/111967] [12/13 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all since r12-4694

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

--- Comment #6 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:80bf483565a11a34239be47012d0b6990dec6690

commit r13-8121-g80bf483565a11a34239be47012d0b6990dec6690
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Mon Nov 13 08:47:41 2023 +0100

    gimple-range-cache: Fix ICEs when dumping details [PR111967]

    The following testcase ICEs when dumping details.
    When m_ssa_ranges vector is created, it is safe_grow_cleared
(num_ssa_names),
    but when when some new SSA_NAME is added, we strangely grow it to
    num_ssa_names + 1 instead and later on the 3 argument dump method
    iterates from 1 to m_ssa_ranges.length () - 1 and uses ssa_name (x)
    on each; but because set_bb_range grew it one too much, ssa_name
    (m_ssa_ranges.length () - 1) might be after the end of the ssanames
    vector and ICE.

    The fix grows the vector consistently only to num_ssa_names,
    doesn't waste time checking m_ssa_ranges[0] because there is no
    ssa_names (0), it is always NULL, before using ssa_name (x) checks
    if we'll need it at all (we check later if m_ssa_ranges[x] is non-NULL,
    so we might check it earlier as well) and also in the last loop
    iterates until m_ssa_ranges.length () rather than num_ssa_names, I don't
    see a reason for the inconsistency and in theory some SSA_NAME could be
    added without set_bb_range called for it and the vector could be shorter
    than the ssanames vector.

    To actually fix the ICE, either the first hunk or the last 2 hunks
    would be enough, but I think it doesn't hurt to change all the spots.

    2023-11-13  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/111967
            * gimple-range-cache.cc (block_range_cache::set_bb_range): Grow
            m_ssa_ranges to num_ssa_names rather than num_ssa_names + 1.
            (block_range_cache::dump): Iterate from 1 rather than 0.  Don't use
            ssa_name (x) unless m_ssa_ranges[x] is non-NULL.  Iterate to
            m_ssa_ranges.length () rather than num_ssa_names.

            * gcc.dg/tree-ssa/pr111967.c: New test.

    (cherry picked from commit 5a0c302d2d721b9650c1e354695dbba87364c334)

[Bug tree-optimization/111967] [12 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all since r12-4694

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13 Regression] during   |[12 Regression] during
                   |GIMPLE pass: evrp ICE: in   |GIMPLE pass: evrp ICE: in
                   |operator[], at vec.h:910    |operator[], at vec.h:910
                   |with -O2 -fno-tree-forwprop |with -O2 -fno-tree-forwprop
                   |-fdump-tree-evrp-all since  |-fdump-tree-evrp-all since
                   |r12-4694                    |r12-4694

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Now fixed for 13.3 as well.

[Bug tree-optimization/111967] [12 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all since r12-4694

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

--- Comment #8 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:327713d54122ab5635f3c385aecf113e5afe190c

commit r12-10049-g327713d54122ab5635f3c385aecf113e5afe190c
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Mon Nov 13 08:47:41 2023 +0100

    gimple-range-cache: Fix ICEs when dumping details [PR111967]

    The following testcase ICEs when dumping details.
    When m_ssa_ranges vector is created, it is safe_grow_cleared
(num_ssa_names),
    but when when some new SSA_NAME is added, we strangely grow it to
    num_ssa_names + 1 instead and later on the 3 argument dump method
    iterates from 1 to m_ssa_ranges.length () - 1 and uses ssa_name (x)
    on each; but because set_bb_range grew it one too much, ssa_name
    (m_ssa_ranges.length () - 1) might be after the end of the ssanames
    vector and ICE.

    The fix grows the vector consistently only to num_ssa_names,
    doesn't waste time checking m_ssa_ranges[0] because there is no
    ssa_names (0), it is always NULL, before using ssa_name (x) checks
    if we'll need it at all (we check later if m_ssa_ranges[x] is non-NULL,
    so we might check it earlier as well) and also in the last loop
    iterates until m_ssa_ranges.length () rather than num_ssa_names, I don't
    see a reason for the inconsistency and in theory some SSA_NAME could be
    added without set_bb_range called for it and the vector could be shorter
    than the ssanames vector.

    To actually fix the ICE, either the first hunk or the last 2 hunks
    would be enough, but I think it doesn't hurt to change all the spots.

    2023-11-13  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/111967
            * gimple-range-cache.cc (block_range_cache::set_bb_range): Grow
            m_ssa_ranges to num_ssa_names rather than num_ssa_names + 1.
            (block_range_cache::dump): Iterate from 1 rather than 0.  Don't use
            ssa_name (x) unless m_ssa_ranges[x] is non-NULL.  Iterate to
            m_ssa_ranges.length () rather than num_ssa_names.

            * gcc.dg/tree-ssa/pr111967.c: New test.

    (cherry picked from commit 5a0c302d2d721b9650c1e354695dbba87364c334)

[Bug tree-optimization/111967] [12 Regression] during GIMPLE pass: evrp ICE: in operator[], at vec.h:910 with -O2 -fno-tree-forwprop -fdump-tree-evrp-all since r12-4694

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111967

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.