[Bug middle-end/113228] New: [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[Bug middle-end/113228] New: [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[patrick at rivosinc dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

            Bug ID: 113228
           Summary: [14 Regression] ICE: recalculate_side_effects, at
                    gimplify.cc:3347
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: patrick at rivosinc dot com
  Target Milestone: ---

Created attachment 56987
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56987&action=edit
-freport-bug output

> /scratch/tc-testing/tc-jan-3-trunk/build-rv64gcv/bin/riscv64-unknown-linux-gnu-gcc -O3 red.c -o rv64gcv.out
during GIMPLE pass: reassoc
red.c: In function 'f':
red.c:15:21: internal compiler error: in recalculate_side_effects, at
gimplify.cc:3347
   15 |         k[0] = k[0] == 0;
      |                ~~~~~^~~~
0x9ec97b recalculate_side_effects
        ../../../gcc/gcc/gimplify.cc:3347
0xf7c9ee gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        ../../../gcc/gcc/gimplify.cc:18589
0xfa2791 force_gimple_operand_1(tree_node*, gimple**, bool (*)(tree_node*),
tree_node*)
        ../../../gcc/gcc/gimplify-me.cc:78
0xfa28f1 force_gimple_operand_gsi_1(gimple_stmt_iterator*, tree_node*, bool
(*)(tree_node*), tree_node*, bool, gsi_iterator_update)
        ../../../gcc/gcc/gimplify-me.cc:115
0xfa28f1 force_gimple_operand_gsi(gimple_stmt_iterator*, tree_node*, bool,
tree_node*, bool, gsi_iterator_update)
        ../../../gcc/gcc/gimplify-me.cc:141
0x14afa61 force_into_ssa_name
        ../../../gcc/gcc/tree-ssa-reassoc.cc:2765
0x14b4b28 update_range_test
        ../../../gcc/gcc/tree-ssa-reassoc.cc:2972
0x14c0b77 optimize_range_tests
        ../../../gcc/gcc/tree-ssa-reassoc.cc:4139
0x14c36b6 reassociate_bb
        ../../../gcc/gcc/tree-ssa-reassoc.cc:7100
0x14c38a8 reassociate_bb
        ../../../gcc/gcc/tree-ssa-reassoc.cc:7265
0x14c38a8 reassociate_bb
        ../../../gcc/gcc/tree-ssa-reassoc.cc:7265
0x14c38a8 reassociate_bb
        ../../../gcc/gcc/tree-ssa-reassoc.cc:7265
0x14c5ef3 do_reassoc
        ../../../gcc/gcc/tree-ssa-reassoc.cc:7377
0x14c5ef3 execute_reassoc
        ../../../gcc/gcc/tree-ssa-reassoc.cc:7466
0x14c5ef3 execute
        ../../../gcc/gcc/tree-ssa-reassoc.cc:7507
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

Found on riscv but also shows up on x86/arm

Godbolt: https://godbolt.org/z/j4786cav7

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[patrick at rivosinc dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #1 from Patrick O'Neill <patrick at rivosinc dot com> ---
Testcase:
int a;
long b;
signed c;
short d;
short i;
void f() {
  int k[3];
  int *l = &a;
  d = 0;
  for (; c; c--) {
    i = 0;
    for (; i <= 9; i++) {
      b = 1;
      for (; b <= 4; b++)
        k[0] = k[0] == 0;
      *l |= k[d];
    }
  }
}

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-01-04
             Status|UNCONFIRMED                 |NEW

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed, I am 99% sure this was exposed by
r14-6420-g85c5efcffed19ca6160eeecc2d4faebd9fee63aa ....

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(gdb) p debug_tree(*expr_p)
 <ssa_name 0x7ffff730b9d8
    type <integer_type 0x7ffff741c5e8 int sizes-gimplified public SI
        size <integer_cst 0x7ffff741f150 constant 32>
        unit-size <integer_cst 0x7ffff741f168 constant 4>
        align:32 warn_if_not_align:0 symtab:0 alias-set 2 canonical-type
0x7ffff741c5e8 precision:32 min <integer_cst 0x7ffff741f108 -2147483648> max
<integer_cst 0x7ffff741f120 2147483647>
        pointer_to_this <pointer_type 0x7ffff7424b28>>
    visited var <var_decl 0x7ffff73427e0 k$0>
    def_stmt k$0_17 = PHI <_24(4), k$0_28(D)(3)>
    version:17
    ptr-info 0x7ffff7343cc0>

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Patrick O'Neill from comment #1)
>   int k[3];

It would better if we didn't depend on an uninitialized variable (I have a
patch against reassoc to not handle uninitialized/undef names) and initializing
k as:
```
int k[3]={0,0,0};
```

Still shows the issue ...

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
```
#6  0x0000000000d4594f in force_gimple_operand_gsi (gsi=0x7fffffffd3c0,
expr=0x7ffff79fe6e0, simple_p=true, var=0x0, before=true, m=GSI_SAME_STMT) at
../../gcc/gimplify-me.cc:141
141       return force_gimple_operand_gsi_1 (gsi, expr,
(gdb) p expr
$1 = (tree) 0x7ffff79fe6e0
(gdb) p debug_tree(expr)
 <ne_expr 0x7ffff79fe6e0
    type <boolean_type 0x7ffff7822b28 _Bool public unsigned QI
        size <integer_cst 0x7ffff7824048 constant 8>
        unit-size <integer_cst 0x7ffff7824060 constant 1>
        align:8 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff7822b28 precision:1 min <integer_cst 0x7ffff78242a0 0> max <integer_cst
0x7ffff78242d0 1>>

    arg:0 <ssa_name 0x7ffff79de510
        type <integer_type 0x7ffff78225e8 int sizes-gimplified public SI
            size <integer_cst 0x7ffff7824198 constant 32>
            unit-size <integer_cst 0x7ffff78241b0 constant 4>
            align:32 warn_if_not_align:0 symtab:0 alias-set 1 canonical-type
0x7ffff78225e8 precision:32 min <integer_cst 0x7ffff7824150 -2147483648> max
<integer_cst 0x7ffff7824168 2147483647>
            pointer_to_this <pointer_type 0x7ffff782ab28>>
        visited var <var_decl 0x7ffff79da480 k$0>
        def_stmt k$0_17 = PHI <_23(4), 0(3)>
        version:17
        ptr-info 0x7ffff79ed390>
    arg:1 <integer_cst 0x7ffff78242e8 type <integer_type 0x7ffff78225e8 int>
constant 0>
    t.c:15:21 start: t.c:15:16 finish: t.c:15:24>
$2 = void
(gdb) p debug_generic_expr(expr)
k$0_17 != 0

```

Exactly what I had expected. and yes it is exposed by that ...

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
What match is doing is correct, what reassoc is doing looks to be ok, but the
gimplifier just falls over on `SSA_NAME != 0`.

This fixes the ICE but I don't understand how the gimplifier was handling
SSA_NAME before if it ever was, the code mentioned here has not changed since
the tuples was merged in:
```
diff --git a/gcc/gimplify.cc b/gcc/gimplify.cc
index 15b540646c2..0cbe159b383 100644
--- a/gcc/gimplify.cc
+++ b/gcc/gimplify.cc
@@ -3304,6 +3304,9 @@ recalculate_side_effects (tree t)
   int len = TREE_OPERAND_LENGTH (t);
   int i;

+  if (code == SSA_NAME)
+    return;
+
   switch (TREE_CODE_CLASS (code))
     {
     case tcc_expression:
@@ -18253,7 +18256,7 @@ gimplify_expr (tree *expr_p, gimple_seq *pre_p,
gimple_seq *post_p,
        case SSA_NAME:
          /* Allow callbacks into the gimplifier during optimization.  */
          ret = GS_ALL_DONE;
-         break;
+         goto dont_recalculate;

        case OMP_PARALLEL:
          gimplify_omp_parallel (expr_p, pre_p);

```

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
This seems like a reduced testcase, where is the original testcase from? Or is
it an automated code generator?

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[patrick at rivosinc dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #8 from Patrick O'Neill <patrick at rivosinc dot com> ---
(In reply to Andrew Pinski from comment #7)
> This seems like a reduced testcase, where is the original testcase from? Or
> is it an automated code generator?

This was found with the fuzzer we're using to try to nail down some spec fails
in risc-v vector [1]. We've had some success with this approach.

I can share the unreduced testcase if that's interesting to you?

[1]: Csmith used w/ scripts to compare risc-v qemu with native build/runs:
https://github.com/patrick-rivos/gcc-fuzz-ci

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #9 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Patrick O'Neill from comment #8)
> (In reply to Andrew Pinski from comment #7)
> > This seems like a reduced testcase, where is the original testcase from? Or
> > is it an automated code generator?
> 
> This was found with the fuzzer we're using to try to nail down some spec
> fails in risc-v vector [1]. We've had some success with this approach.

Oh ok, I was deciding if I should look further into this or let someone else
handle it. Since it is from a fuzzer, I am just going to say I don't have time
to look into this latent bug even though I exposed it :).

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347

[patrick at rivosinc dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #10 from Patrick O'Neill <patrick at rivosinc dot com> ---
(In reply to Andrew Pinski from comment #9)
> Oh ok, I was deciding if I should look further into this or let someone else
> handle it. Since it is from a fuzzer, I am just going to say I don't have
> time to look into this latent bug even though I exposed it :).

Makes sense, I'll start adding a little blurb to future testcases that come
from the fuzzer so people can prioritize accordingly.

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347 since r14-6420

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
            Summary|[14 Regression] ICE:        |[14 Regression] ICE:
                   |recalculate_side_effects,   |recalculate_side_effects,
                   |at gimplify.cc:3347         |at gimplify.cc:3347 since
                   |                            |r14-6420
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Confirmed this started with r14-6420-g85c5efcffed19ca6160eeecc2d4faebd9fee63aa
Reproduceable also on x86_64-linux with -O3.

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347 since r14-6420

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
The reason why late gimplification/regimplification generally works fine with
SSA_NAMEs is that the
        case SSA_NAME:
          /* Allow callbacks into the gimplifier during optimization.  */
          ret = GS_ALL_DONE;
          break;
case doesn't fall through into the recalculation.  It is just this new match.pd
folding which can turn a tcc_comparison *expr_p (which is what generally wants
to recalculate side-effects) into SSA_NAME (which isn't handled there).

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347 since r14-6420

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 56991
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56991&action=edit
gcc14-pr113228.patch

So I'd just go with a simple patch to recalculate_side_effects.
Changing the case SSA_NAME: in gimplify_expr obviously isn't needed, that works
fine as is.

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347 since r14-6420

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #14 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #12)
> The reason why late gimplification/regimplification generally works fine
> with SSA_NAMEs is that the
>         case SSA_NAME:
>           /* Allow callbacks into the gimplifier during optimization.  */
>           ret = GS_ALL_DONE;
>           break;
> case doesn't fall through into the recalculation.  It is just this new
> match.pd folding which can turn a tcc_comparison *expr_p (which is what
> generally wants to recalculate side-effects) into SSA_NAME (which isn't
> handled there).

Thanks for looking into this issue further and handling it.

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347 since r14-6420

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

--- Comment #15 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:8c0dd8a6ff85d6e7b38957f2da400f5cfa8fef6b

commit r14-7002-g8c0dd8a6ff85d6e7b38957f2da400f5cfa8fef6b
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Mon Jan 8 13:59:15 2024 +0100

    gimplify: Fix ICE in recalculate_side_effects [PR113228]

    The following testcase ICEs during regimplificatgion since the addition of
    (convert (eqne zero_one_valued_p@0 INTEGER_CST@1))
    simplification.  That simplification is novel in the sense that in
    gimplify_expr it can turn an expression (comparison in particular) into
    a SSA_NAME.  Normally when gimplify_expr sees originally a SSA_NAME, it
does
            case SSA_NAME:
              /* Allow callbacks into the gimplifier during optimization.  */
              ret = GS_ALL_DONE;
              break;
    and doesn't try to recalculate side effects because of that, but in this
    case gimplify_expr normally enters the:
            default:
              switch (TREE_CODE_CLASS (TREE_CODE (*expr_p)))
                {
                case tcc_comparison:
    then does
                          *expr_p = gimple_boolify (*expr_p);
    and then
                              *expr_p = fold_convert_loc (input_location,
                                                          org_type, *expr_p);
    with this new match.pd simplification turns that tcc_comparison class
    into SSA_NAME.  Unlike the outer SSA_NAME handling though, this falls
    through into
              recalculate_side_effects (*expr_p);

            dont_recalculate:
              break;
    but unfortunately recalculate_side_effects doesn't handle SSA_NAME and ICEs
    on it.
    SSA_NAMEs don't ever have TREE_SIDE_EFFECTS set on those, so the following
    patch fixes it by handling it similarly to the tcc_constant case.

    2024-01-08  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/113228
            * gimplify.cc (recalculate_side_effects): Do nothing for SSA_NAMEs.

            * gcc.c-torture/compile/pr113228.c: New test.

[Bug middle-end/113228] [14 Regression] ICE: recalculate_side_effects, at gimplify.cc:3347 since r14-6420

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113228

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #16 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.