[Bug tree-optimization/112827] New: ICE on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[Bug tree-optimization/112827] New: ICE on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112827

            Bug ID: 112827
           Summary: ICE on valid code at -O1 on x86_64-linux-gnu:
                    Segmentation fault
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

This appears to be a recent regression as it does not reproduce with 13.2. 

Compiler Explorer: https://godbolt.org/z/4EhdjPE6o

[507] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/home/suz/suz-local/software/local/gcc-trunk/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.0 20231202 (experimental) (GCC) 
[508] % 
[508] % gcctk -O1 small.c
during GIMPLE pass: sccp
small.c: In function ‘main’:
small.c:2:5: internal compiler error: Segmentation fault
    2 | int main() {
      |     ^~~~
0x105e273 crash_signal
        ../../gcc-trunk/gcc/toplev.cc:316
0x1149492 gimple_bb(gimple const*)
        ../../gcc-trunk/gcc/gimple.h:1908
0x1149492 instantiate_scev_name
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2263
0x1149492 instantiate_scev_r
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2637
0x1149dee instantiate_scev(edge_def*, loop*, tree_node*)
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2719
0x114bae9 instantiate_parameters(loop*, tree_node*)
        ../../gcc-trunk/gcc/tree-scalar-evolution.h:64
0x114bae9 simplify_peeled_chrec
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1344
0x11488a6 analyze_evolution_in_loop
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1455
0x11488a6 interpret_loop_phi
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1587
0x11488a6 analyze_scalar_evolution_1
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1975
0x114849a analyze_scalar_evolution_1
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1958
0x1148e24 analyze_scalar_evolution(loop*, tree_node*)
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2039
0x11483ee interpret_condition_phi
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1611
0x11483ee analyze_scalar_evolution_1
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1977
0x1148e24 analyze_scalar_evolution(loop*, tree_node*)
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2039
0x114abd2 interpret_rhs_expr
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1641
0x1148579 interpret_gimple_assign
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1919
0x1148579 analyze_scalar_evolution_1
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1970
0x1148e24 analyze_scalar_evolution(loop*, tree_node*)
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2039
0x114abd2 interpret_rhs_expr
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1641
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[509] % 
[509] % cat small.c
int a, b, c, d, e;
int main() {
  for (; c; c++) {
    for (a = 0; a < 2; a++)
      ;
    for (; b; b++) {
      e = d;
      d = a;
    }
  }
  return 0;
}

[Bug tree-optimization/112827] [14 Regression] ICE on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112827

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Target Milestone|---                         |14.0
            Summary|ICE on valid code at -O1 on |[14 Regression] ICE on
                   |x86_64-linux-gnu:           |valid code at -O1 on
                   |Segmentation fault          |x86_64-linux-gnu:
                   |                            |Segmentation fault
   Last reconfirmed|                            |2023-12-02

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/112827] [14 Regression] ICE on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112827

--- Comment #2 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Another test that reproduces at -O1 and above.

[520] % gcctk -O3 small.c
during GIMPLE pass: sccp
small.c: In function ‘main’:
small.c:4:5: internal compiler error: Segmentation fault
    4 | int main() {
      |     ^~~~
0x105e613 crash_signal
        ../../gcc-trunk/gcc/toplev.cc:316
0x1149882 gimple_bb(gimple const*)
        ../../gcc-trunk/gcc/gimple.h:1908
0x1149882 instantiate_scev_name
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2263
0x1149882 instantiate_scev_r
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2637
0x114977d instantiate_scev_poly
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2410
0x114977d instantiate_scev_r
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2642
0x114a1de instantiate_scev(edge_def*, loop*, tree_node*)
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:2719
0x12027c5 instantiate_parameters(loop*, tree_node*)
        ../../gcc-trunk/gcc/tree-scalar-evolution.h:64
0x12027c5 idx_infer_loop_bounds
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:4154
0x1217343 for_each_index(tree_node**, bool (*)(tree_node*, tree_node**, void*),
void*)
        ../../gcc-trunk/gcc/tree-ssa-loop.cc:571
0x11ffa7d infer_loop_bounds_from_ref
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:4230
0x11ffa7d infer_loop_bounds_from_array
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:4251
0x11ffa7d infer_loop_bounds_from_undefined
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:4408
0x11ffa7d estimate_numbers_of_iterations(loop*)
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:4866
0x1201caf loop_exits_before_overflow
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:5253
0x1201caf scev_probably_wraps_p(tree_node*, tree_node*, tree_node*, gimple*,
loop*, bool)
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:5505
0x1201caf scev_probably_wraps_p(tree_node*, tree_node*, tree_node*, gimple*,
loop*, bool)
        ../../gcc-trunk/gcc/tree-ssa-loop-niter.cc:5463
0x2033067 convert_affine_scev(loop*, tree_node*, tree_node**, tree_node**,
gimple*, bool, tree_node*)
        ../../gcc-trunk/gcc/tree-chrec.cc:1425
0x2032abe chrec_convert_1
        ../../gcc-trunk/gcc/tree-chrec.cc:1483
0x114a923 scev_dfs::follow_ssa_edge_expr(gimple*, tree_node*, tree_node**, int)
        ../../gcc-trunk/gcc/tree-scalar-evolution.cc:1238
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[521] % 
[521] % cat small.c
short a, b[1], f;
char c, g;
int d, e;
int main() {
  for (; f; f++) {
    for (d = 0; d < 2; d++)
      ;
    if (a)
      for (g = 0; g < 2; g++)
        for (c = 0; c < 2; c += b[d+g])
          ;
    for (; e; e++)
      ;
  }
  return 0;
}

[Bug tree-optimization/112827] [14 Regression] ICE on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112827

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
            Version|unknown                     |14.0
           Priority|P3                          |P1
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Target|                            |x86_64-*-*

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Sounds like mine.

[Bug tree-optimization/112827] [14 Regression] ICE on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112827

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |shaohua.li at inf dot ethz.ch

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
*** Bug 112831 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/112827] [14 Regression] ICE on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112827

--- Comment #5 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:de0ab339a795352c843f6e9b2dfce222f26588de

commit r14-6114-gde0ab339a795352c843f6e9b2dfce222f26588de
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Dec 4 10:46:11 2023 +0100

    tree-optimization/112827 - corrupt SCEV cache during SCCP

    The following avoids corrupting the SCEV cache by my last change
    to propagate constant final values immediately.  The easiest fix
    is to keep a dead initialization around.

            PR tree-optimization/112827
            * tree-scalar-evolution.cc (final_value_replacement_loop):
            Do not release SSA name but keep a dead initialization around.

            * gcc.dg/torture/pr112827-1.c: New testcase.
            * gcc.dg/torture/pr112827-2.c: Likewise.

[Bug tree-optimization/112827] [14 Regression] ICE on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112827

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/112827] [14 Regression] ICE on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112827

--- Comment #7 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:50f2a3370d177f8fe9bea0461feb710523e048a2

commit r14-6132-g50f2a3370d177f8fe9bea0461feb710523e048a2
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Dec 4 15:46:38 2023 +0100

    tree-optimization/112827 - more SCEV cprop fixes

    The insert iteration can be corrupted by foldings of replace_uses_by,
    within this particular PHI replacement but also with subsequent ones.
    Recompute the insert location before insertion instead.

    This fixes an obvserved ICE of gcc.dg/tree-ssa/ssa-sink-16.c.

            PR tree-optimization/112827
            PR tree-optimization/112848
            * tree-scalar-evolution.cc (final_value_replacement_loop):
            Compute the insert location for each insert.

[Bug tree-optimization/112827] [14 Regression] ICE on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112827

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |csfore at posteo dot net

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
*** Bug 112924 has been marked as a duplicate of this bug. ***