[Bug tree-optimization/112469] New: [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[Bug tree-optimization/112469] New: [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[patrick at rivosinc dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

            Bug ID: 112469
           Summary: [14 Regression] ICE: eliminate_stmt, at
                    tree-ssa-sccvn.cc:6944
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: patrick at rivosinc dot com
  Target Milestone: ---

Created attachment 56548
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56548&action=edit
-freport-bug output

> ./bin/riscv64-unknown-linux-gnu-gcc -march=rv64gcv -S -O3 red.c -freport-bug
during GIMPLE pass: fre
red.c: In function 'g':
red.c:4:5: internal compiler error: in eliminate_stmt, at
tree-ssa-sccvn.cc:6944
    4 | int g() {
      |     ^
0xa1cc99 eliminate_dom_walker::eliminate_stmt(basic_block_def*,
gimple_stmt_iterator*)
        ../../../gcc/gcc/tree-ssa-sccvn.cc:6944
0x13efe11 process_bb
        ../../../gcc/gcc/tree-ssa-sccvn.cc:8152
0x13f1712 do_rpo_vn_1
        ../../../gcc/gcc/tree-ssa-sccvn.cc:8602
0x13f3118 execute
        ../../../gcc/gcc/tree-ssa-sccvn.cc:8760
Please submit a full bug report, with preprocessed source.
Please include the complete backtrace with any bug report.

Creduced testcase:
int a, b, c;
static int *d = &a;
int e(int f) { return f == 0 ?: f; }
int g() {
  a = 1;
  for (; a <= 8; a++) {
    b = e(*d);
    c = -b;
  }
}

Bisected to/first bad commit: r14-4221-g8a87ba0b4fe

-freport-bug output attached

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0
           Keywords|                            |ice-on-valid-code
                 CC|                            |pinskia at gcc dot gnu.org

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-11-09

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I don't see anything wrong with that patch but just exposing a latent bug in
SCCVN/FRE:

```
Value numbering stmt = vect_iftmp.22_46 = VEC_COND_EXPR <mask__23.21_44, { 1,
1, 1, 1, 1, 1, 1, 1 }, { 1, 2, 3, 4, 5, 6, 7, 8 }>;
Applying pattern match.pd:5029, generic-match-7.cc:9560
Match-and-simplified VEC_COND_EXPR <mask__23.21_44, { 1, 1, 1, 1, 1, 1, 1, 1 },
{ 1, 2, 3, 4, 5, 6, 7, 8 }> to { 1, 2, 3, 4, 5, 6, 7, 8 }
RHS VEC_COND_EXPR <mask__23.21_44, { 1, 1, 1, 1, 1, 1, 1, 1 }, { 1, 2, 3, 4, 5,
6, 7, 8 }> simplified to { 1, 2, 3, 4, 5, 6, 7, 8 }
Setting value number of vect_iftmp.22_46 to { 1, 2, 3, 4, 5, 6, 7, 8 }
(changed)
Replaced VEC_COND_EXPR <mask__23.21_44, { 1, 1, 1, 1, 1, 1, 1, 1 }, { 1, 2, 3,
4, 5, 6, 7, 8 }> with { 1, 2, 3, 4, 5, 6, 7, 8 } in all uses of
vect_iftmp.22_46 = VEC_COND_EXPR <mask__23.21_44, { 1, 1, 1, 1, 1, 1, 1, 1 }, {
1, 2, 3, 4, 5, 6, 7, 8 }>;
Value numbering stmt = _55 = { -1, -1, -1, -1, -1, -1, -1, -1 };
RHS { -1, -1, -1, -1, -1, -1, -1, -1 } simplified to { -1, -1, -1, -1, -1, -1,
-1, -1 }
Setting value number of _55 to { -1, -1, -1, -1, -1, -1, -1, -1 } (changed)
Value numbering stmt = vect_prephitmp_11.23_50 = .COND_NEG (_55,
vect__29.18_40, { -1, -1, -1, -1, -1, -1, -1, -1 });
Applying pattern match.pd:5027, generic-match-7.cc:9542
Match-and-simplified .COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1, -1, -1,
-1, -1 }) to { 4294967295, 4294967294, 4294967293, 4294967292, 4294967291,
4294967290, 4294967289, 4294967288 }
call .COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1, -1, -1, -1, -1 })
simplified to { 4294967295, 4294967294, 4294967293, 4294967292, 4294967291,
4294967290, 4294967289, 4294967288 }
Setting value number of vect_prephitmp_11.23_50 to { 4294967295, 4294967294,
4294967293, 4294967292, 4294967291, 4294967290, 4294967289, 4294967288 }
(changed)
Replaced .COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1, -1, -1, -1, -1 })
with { 4294967295, 4294967294, 4294967293, 4294967292, 4294967291, 4294967290,
4294967289, 4294967288 } in vect_prephitmp_11.23_50 = .COND_NEG (_55,
vect__29.18_40, { -1, -1, -1, -1, -1, -1, -1, -1 });


```

Then crash.

What we had before FRE4:
```
  _39 = { 9, 10, 11, 12, 13, 14, 15, 16 };
  vect__29.18_40 = { 1, 2, 3, 4, 5, 6, 7, 8 };
  mask__23.21_44 = { 0, 0, 0, 0, 0, 0, 0, 0 };
  vect_iftmp.22_46 = VEC_COND_EXPR <mask__23.21_44, { 1, 1, 1, 1, 1, 1, 1, 1 },
{ 1, 2, 3, 4, 5, 6, 7, 8 }>;
  _55 = { -1, -1, -1, -1, -1, -1, -1, -1 };
  vect_prephitmp_11.23_50 = .COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1,
-1, -1, -1, -1 });
  ivtmp_54 = 1;
  _52 = BIT_FIELD_REF <vect_prephitmp_11.23_50, 32, 224>;
  prephitmp_32 = _52;
  _48 = BIT_FIELD_REF <vect_iftmp.22_46, 32, 224>;
  iftmp.0_31 = _48;
  b = iftmp.0_31;
  c = prephitmp_32;
  a = 9;
```

Confirmed.

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[juzhe.zhong at rivai dot ai]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

--- Comment #2 from JuzheZhong <juzhe.zhong at rivai dot ai> ---
(In reply to Andrew Pinski from comment #1)
> I don't see anything wrong with that patch but just exposing a latent bug in
> SCCVN/FRE:
> 
> ```
> Value numbering stmt = vect_iftmp.22_46 = VEC_COND_EXPR <mask__23.21_44, {
> 1, 1, 1, 1, 1, 1, 1, 1 }, { 1, 2, 3, 4, 5, 6, 7, 8 }>;
> Applying pattern match.pd:5029, generic-match-7.cc:9560
> Match-and-simplified VEC_COND_EXPR <mask__23.21_44, { 1, 1, 1, 1, 1, 1, 1, 1
> }, { 1, 2, 3, 4, 5, 6, 7, 8 }> to { 1, 2, 3, 4, 5, 6, 7, 8 }
> RHS VEC_COND_EXPR <mask__23.21_44, { 1, 1, 1, 1, 1, 1, 1, 1 }, { 1, 2, 3, 4,
> 5, 6, 7, 8 }> simplified to { 1, 2, 3, 4, 5, 6, 7, 8 }
> Setting value number of vect_iftmp.22_46 to { 1, 2, 3, 4, 5, 6, 7, 8 }
> (changed)
> Replaced VEC_COND_EXPR <mask__23.21_44, { 1, 1, 1, 1, 1, 1, 1, 1 }, { 1, 2,
> 3, 4, 5, 6, 7, 8 }> with { 1, 2, 3, 4, 5, 6, 7, 8 } in all uses of
> vect_iftmp.22_46 = VEC_COND_EXPR <mask__23.21_44, { 1, 1, 1, 1, 1, 1, 1, 1
> }, { 1, 2, 3, 4, 5, 6, 7, 8 }>;
> Value numbering stmt = _55 = { -1, -1, -1, -1, -1, -1, -1, -1 };
> RHS { -1, -1, -1, -1, -1, -1, -1, -1 } simplified to { -1, -1, -1, -1, -1,
> -1, -1, -1 }
> Setting value number of _55 to { -1, -1, -1, -1, -1, -1, -1, -1 } (changed)
> Value numbering stmt = vect_prephitmp_11.23_50 = .COND_NEG (_55,
> vect__29.18_40, { -1, -1, -1, -1, -1, -1, -1, -1 });
> Applying pattern match.pd:5027, generic-match-7.cc:9542
> Match-and-simplified .COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1, -1,
> -1, -1, -1 }) to { 4294967295, 4294967294, 4294967293, 4294967292,
> 4294967291, 4294967290, 4294967289, 4294967288 }
> call .COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1, -1, -1, -1, -1 })
> simplified to { 4294967295, 4294967294, 4294967293, 4294967292, 4294967291,
> 4294967290, 4294967289, 4294967288 }
> Setting value number of vect_prephitmp_11.23_50 to { 4294967295, 4294967294,
> 4294967293, 4294967292, 4294967291, 4294967290, 4294967289, 4294967288 }
> (changed)
> Replaced .COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1, -1, -1, -1, -1 })
> with { 4294967295, 4294967294, 4294967293, 4294967292, 4294967291,
> 4294967290, 4294967289, 4294967288 } in vect_prephitmp_11.23_50 = .COND_NEG
> (_55, vect__29.18_40, { -1, -1, -1, -1, -1, -1, -1, -1 });
> 
> 
> ```
> 
> Then crash.
> 
> What we had before FRE4:
> ```
>   _39 = { 9, 10, 11, 12, 13, 14, 15, 16 };
>   vect__29.18_40 = { 1, 2, 3, 4, 5, 6, 7, 8 };
>   mask__23.21_44 = { 0, 0, 0, 0, 0, 0, 0, 0 };
>   vect_iftmp.22_46 = VEC_COND_EXPR <mask__23.21_44, { 1, 1, 1, 1, 1, 1, 1, 1
> }, { 1, 2, 3, 4, 5, 6, 7, 8 }>;
>   _55 = { -1, -1, -1, -1, -1, -1, -1, -1 };
>   vect_prephitmp_11.23_50 = .COND_NEG (_55, vect__29.18_40, { -1, -1, -1,
> -1, -1, -1, -1, -1 });
>   ivtmp_54 = 1;
>   _52 = BIT_FIELD_REF <vect_prephitmp_11.23_50, 32, 224>;
>   prephitmp_32 = _52;
>   _48 = BIT_FIELD_REF <vect_iftmp.22_46, 32, 224>;
>   iftmp.0_31 = _48;
>   b = iftmp.0_31;
>   c = prephitmp_32;
>   a = 9;
> ```
> 
> Confirmed.

Yes. I am agree with Andrew. It's not the RISC-V backend issue.

CCing Richard to see whether we should fix on middle-end or find a way in 
RISC-V backend to walk around this issue.

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I wonder if there is a type issue here ...

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[juzhe.zhong at rivai dot ai]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

--- Comment #4 from JuzheZhong <juzhe.zhong at rivai dot ai> ---
vector(8) int vect_prephitmp_11.23;

is gimplified from 

.COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1, -1, -1, -1, -1 })

into 

vect_prephitmp_11.23_50 to { 4294967295, 4294967294, 4294967293, 4294967292,
4294967291, 4294967290, 4294967289, 4294967288 }


vector(8) unsigned int vect__29.18;

Look like one is int, the other is unsigned int ?

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
So we value-number

vect_prephitmp_11.23_50 = .COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1, -1,
-1, -1, -1 });

as

{ 4294967295, 4294967294, 4294967293, 4294967292, 4294967291, 4294967290,
4294967289, 4294967288 }

where the former is signed int V8SI and the latter unsigned int V8SI.  Happens
via

Value numbering stmt = vect_prephitmp_11.23_50 = .COND_NEG (_55,
vect__29.18_40, { -1, -1, -1, -1, -1, -1, -1, -1 });
Applying pattern match.pd:5031, generic-match-1.cc:9440
Match-and-simplified .COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1, -1, -1,
-1, -1 }) to { 4294967295, 4294967294, 4294967293, 4294967292, 4294967291,
4294967290, 4294967289, 4294967288 }

where _55 == { -1, -1, -1, -1, -1, -1, -1, -1 } and
vect__29.18_40 == { 1, 2, 3, 4, 5, 6, 7, 8 } and we have

  vector(8) unsigned int vect__29.18;

I think the .COND_NEG result has the wrong sign.  We fold this from a
VEC_COND_EXPR during vectorization:

Value numbering stmt = vect_prephitmp_11.23_50 = VEC_COND_EXPR <mask__23.21_44,
vect_cst__49, vect__12.20_42>;
Matching expression match.pd:2187, gimple-match-4.cc:67
Applying pattern match.pd:5926, gimple-match-3.cc:3142
Setting value number of vect_prephitmp_11.23_50 to vect_prephitmp_11.23_50
(changed) 
Matching expression match.pd:2187, gimple-match-4.cc:67
Applying pattern match.pd:5926, gimple-match-3.cc:3142
Applying pattern match.pd:8968, gimple-match-3.cc:19689
gimple_simplified to _55 = vect_vec_iv_.17_38 != { 0, 0, 0, 0, 0, 0, 0, 0 };
vect_prephitmp_11.23_50 = .COND_NEG (_55, vect__29.18_40, { -1, -1, -1, -1, -1,
-1, -1, -1 });

which is

(for uncond_op (UNCOND_UNARY)
     cond_op (COND_UNARY)
..
 (simplify
  (vec_cond @0 @1 (view_convert? (uncond_op@3 @2)))
   (with { tree op_type = TREE_TYPE (@3); }
    (if (vectorized_internal_fn_supported_p (as_internal_fn (cond_op), op_type)
        && is_truth_type_for (op_type, TREE_TYPE (@0)))
     (cond_op (bit_not @0) @2 @1)))))

and because of the view_convert? lacks a view_convert in the result:

diff --git a/gcc/match.pd b/gcc/match.pd
index f559bfa4f2b..2b5e9554020 100644
--- a/gcc/match.pd
+++ b/gcc/match.pd
@@ -8965,7 +8965,7 @@ and,
    (with { tree op_type = TREE_TYPE (@3); }
     (if (vectorized_internal_fn_supported_p (as_internal_fn (cond_op),
op_type)
         && is_truth_type_for (op_type, TREE_TYPE (@0)))
-     (cond_op (bit_not @0) @2 @1)))))
+     (cond_op (bit_not @0) (view_convert @2) @1)))))

 (for uncond_op (UNCOND_UNARY)
      cond_op (COND_LEN_UNARY)

fixes this.

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[juzhe.zhong at rivai dot ai]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

--- Comment #6 from JuzheZhong <juzhe.zhong at rivai dot ai> ---
Thanks Richard.

I tried your patch. It does fix this issue.

But I wonder whether we should also adjust the following COND_LEN_UNARY too ?

Like this:

diff --git a/gcc/match.pd b/gcc/match.pd
index f559bfa4f2b..145ea925fa9 100644
--- a/gcc/match.pd
+++ b/gcc/match.pd
@@ -8965,7 +8965,7 @@ and,
    (with { tree op_type = TREE_TYPE (@3); }
     (if (vectorized_internal_fn_supported_p (as_internal_fn (cond_op),
op_type)
         && is_truth_type_for (op_type, TREE_TYPE (@0)))
-     (cond_op (bit_not @0) @2 @1)))))
+     (cond_op (bit_not @0) (view_convert @2) @1)))))

 (for uncond_op (UNCOND_UNARY)
      cond_op (COND_LEN_UNARY)
@@ -8980,7 +8980,7 @@ and,
    (with { tree op_type = TREE_TYPE (@3); }
     (if (vectorized_internal_fn_supported_p (as_internal_fn (cond_op),
op_type)
         && is_truth_type_for (op_type, TREE_TYPE (@0)))
-     (cond_op (bit_not @0) @2 @1 @4 @5)))))
+     (cond_op (bit_not @0) (view_convert @2) @1 @4 @5)))))

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Yes, I'm testing a more complete patch right now.

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:20aa06490ab57da7729a24bae7c4ec2f5918ec91

commit r14-5317-g20aa06490ab57da7729a24bae7c4ec2f5918ec91
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Nov 10 09:56:01 2023 +0100

    middle-end/112469 - fix missing converts in vec_cond_expr simplification

    The following avoids type inconsistencies in .COND_op generated by
    simplifications of VEC_COND_EXPRs.

            PR middle-end/112469
            * match.pd (cond ? op a : b -> .COND_op (cond, a, b)): Add
            missing view_converts.

            * gcc.dg/torture/pr112469.c: New testcase.

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/112469] [14 Regression] ICE: eliminate_stmt, at tree-ssa-sccvn.cc:6944

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Pan Li <panli@gcc.gnu.org>:

https://gcc.gnu.org/g:108e93403c461f57437da28348e5d5409ed2adc8

commit r14-5351-g108e93403c461f57437da28348e5d5409ed2adc8
Author: Juzhe-Zhong <juzhe.zhong@rivai.ai>
Date:   Sat Nov 11 07:27:54 2023 +0800

    RISC-V: Add test for PR112469

    As PR: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112469

    which has been fixed by Richard patch:
    https://gcc.gnu.org/pipermail/gcc-patches/2023-November/635994.html

    Add tests to avoid regression. Committed.

            PR target/112469

    gcc/testsuite/ChangeLog:

            * gcc.target/riscv/rvv/autovec/pr112469.c: New test.