[Bug c++/113757] New: [14 regression] ICE when building legion-23.03.0

[Bug c++/113757] New: [14 regression] ICE when building legion-23.03.0

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

            Bug ID: 113757
           Summary: [14 regression] ICE when building legion-23.03.0
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sjames at gcc dot gnu.org
  Target Milestone: ---

Created attachment 57319
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57319&action=edit
legion_tasks.cc.ii.xz

Originally reported downstream in Gentoo at https://bugs.gentoo.org/923797 by 
Toralf Förster.

```
$
/var/tmp/portage/sys-cluster/legion-23.03.0/temp/clang-wrappers/x86_64-pc-linux-gnu-g++
-DLegionRuntime_EXPORTS
-I/var/tmp/portage/sys-cluster/legion-23.03.0/work/legion-legion-23.03.0/runtime
-I/var/tmp/portage/sys-cluster/legion-23.03.0/work/legion-legion-23.03.0_build/runtime
 -O2 -march=znver2 -march=native -O2 -g -fPIC -fdiagnostics-color=always -MD
-MT runtime/CMakeFiles/LegionRuntime.dir/legion/legion_tasks.cc.o -MF
runtime/CMakeFiles/LegionRuntime.dir/legion/legion_tasks.cc.o.d -o
runtime/CMakeFiles/LegionRuntime.dir/legion/legion_tasks.cc.o -c
/var/tmp/portage/sys-cluster/legion-23.03.0/work/legion-legion-23.03.0/runtime/legion/legion_tasks.cc
during IPA pass: inline
/var/tmp/portage/sys-cluster/legion-23.03.0/work/legion-legion-23.03.0/runtime/legion/legion_tasks.cc:
In member function ‘virtual const Legion::Internal::VersionInfo&
Legion::Internal::PointTask::get_version_info(unsigned int) const’:
/var/tmp/portage/sys-cluster/legion-23.03.0/work/legion-legion-23.03.0/runtime/legion/legion_tasks.cc:7033:24:
internal compiler error: tree check: expected class ‘type’, have ‘exceptional’
(error_mark) in useless_type_conversion_p, at gimple-expr.cc:85
 7033 |     const VersionInfo& PointTask::get_version_info(unsigned idx) const
      |                        ^~~~~~~~~


0x5611c9270657 tree_class_check_failed(tree_node const*, tree_code_class, char
const*, int, char const*)
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree.cc:9002
0x5611c81c7150 tree_class_check(tree_node*, tree_code_class, char const*, int,
char const*)
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree.h:3767
0x5611c81c7150 useless_type_conversion_p(tree_node*, tree_node*)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/gimple-expr.cc:85
0x5611c9dc377f may_propagate_copy(tree_node*, tree_node*, bool)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-propagate.cc:1068
0x5611c9ceafbc gimple_merge_blocks
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-cfg.cc:2130
0x5611c9ce61dd merge_blocks(basic_block_def*, basic_block_def*)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/cfghooks.cc:820
0x5611c9c46209 cleanup_tree_cfg_bb
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-cfgcleanup.cc:791
0x5611c9c46209 cleanup_tree_cfg_noloop
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-cfgcleanup.cc:1141
0x5611c9c46209 cleanup_tree_cfg(unsigned int)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-cfgcleanup.cc:1205
0x5611c9ae1bf4 execute_function_todo
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:2057
0x5611c9ae1bf4 do_per_function
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:1687
0x5611c9ae1bf4 execute_todo
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:2142
0x5611c9cbcfca execute_one_ipa_transform_pass
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:2336
0x5611c9cbcfca execute_all_ipa_transforms(bool)
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:2396
0x5611c9b20cb3 cgraph_node::expand()
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/cgraphunit.cc:1836
0x5611c9adacd0 expand_all_functions
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/cgraphunit.cc:2026
0x5611c9adacd0 symbol_table::compile()
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/cgraphunit.cc:2400
0x5611ca40f9c8 symbol_table::finalize_compilation_unit()
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/cgraphunit.cc:2585
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.
```

```
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-pc-linux-gnu/14/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with:
/var/tmp/portage/sys-devel/gcc-14.0.9999/work/gcc-14.0.9999/configure
--host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --prefix=/usr
--bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/14
--includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/14/include
--datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14
--mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14/man
--infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14/info
--with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/14/include/g++-v14
--disable-silent-rules --disable-dependency-tracking
--with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/14/python
--enable-languages=c,c++,fortran,rust --enable-obsolete --enable-secureplt
--disable-werror --with-system-zlib --enable-nls --without-included-gettext
--disable-libunwind-exceptions --enable-checking=yes,extra,rtl
--with-bugurl=https://bugs.gentoo.org/ --with-pkgversion='Gentoo Hardened
14.0.9999 p, commit 3ab6b70bf9ee185da7e092e1df20753cdc35d710'
--with-gcc-major-version-only --enable-libstdcxx-time --enable-lto
--disable-libstdcxx-pch --enable-shared --enable-threads=posix
--enable-__cxa_atexit --enable-clocale=gnu --enable-multilib
--with-multilib-list=m32,m64 --disable-fixed-point --enable-targets=all
--enable-libgomp --disable-libssp --disable-libada --disable-cet
--disable-systemtap --enable-valgrind-annotations --disable-vtable-verify
--disable-libvtv --with-zstd --with-isl --disable-isl-version-check
--enable-default-pie --enable-host-pie --enable-host-bind-now
--enable-default-ssp --with-build-config='bootstrap-O3 bootstrap-lto'
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.1 20240203 (experimental)
fa96099957c1cdcf73cb8c83e4f694a38a3d8530 (Gentoo Hardened 14.0.9999 p, commit
3ab6b70bf9ee185da7e092e1df20753cdc35d710)
```

[Bug c++/113757] [14 regression] ICE when building legion-23.03.0

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

--- Comment #1 from Sam James <sjames at gcc dot gnu.org> ---
I will try reduce it but my track record with C++ isn't good ;)

[Bug c++/113757] [14 regression] ICE when building legion-23.03.0

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

--- Comment #2 from Sam James <sjames at gcc dot gnu.org> ---
needs -O2 -march=znver2 -fPIC (the znver2 is just an artefact of how I built it
though, didn't bother trying it without w/o preprocessed)

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Sam James from comment #1)
> I will try reduce it but my track record with C++ isn't good ;)

I am reducing it too.

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0 since r14-8398

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-02-04
            Summary|[14 regression] ICE when    |[14 regression] ICE when
                   |building legion-23.03.0     |building legion-23.03.0
                   |                            |since r14-8398
                 CC|                            |jakub at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
           Priority|P3                          |P1

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r14-8398-ga9a8426e534760b8d3a250e9bd3cff4db131a2be

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0 since r14-8398

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

--- Comment #5 from Sam James <sjames at gcc dot gnu.org> ---
reduced but with return-type UB:
```
template <typename _Alloc> struct __alloc_traits {
  typedef typename _Alloc::value_type &const_reference;
};
struct LegionAllocator {
  typedef int value_type;
};
struct vector {
  long size() const;
  __alloc_traits<LegionAllocator>::const_reference operator[](long) const;
};
void __assert_fail();
template <typename> using LegionVector = vector;
struct TaskOp {
  virtual int &get_version_info();
} *slice_owner;
struct PointTask {
  virtual const int &get_version_info() const;
  LegionVector<int> version_infos;
};
int &TaskOp::get_version_info() { __assert_fail(); }
const int &PointTask::get_version_info() const {
  if (version_infos.size())
    return version_infos[0];
  return slice_owner->get_version_info();
}
```

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0 since r14-8398

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-reduction             |

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced a little further without the undefinedness but with a noreturn function
in use (which is important for the ICE here):
```
long size();
struct ll {  virtual int hh();  };
ll  *slice_owner;
int ll::hh() { __builtin_exit(0); }
int nn() {
  if (size())
    return 0;
  return slice_owner->hh();
}
int (*a)() = nn;
```

Note the decl a is needed to force nn to have its address taken (simulating a
virtual function).

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0 since r14-8398

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jamborm at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #7 from Martin Jambor <jamborm at gcc dot gnu.org> ---
This is a very particular interaction of the patch with speculative
devirtualization.  Mine.

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0 since r14-8398

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

--- Comment #8 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I have proposed a fix on the mailing list:
https://inbox.sourceware.org/gcc-patches/ri6bk8r5kfi.fsf@virgil.suse.cz/T/#u

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0 since r14-8398

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Jambor <jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:54e505d0446f86b7ad383acbb8e5501f20872b64

commit r14-9403-g54e505d0446f86b7ad383acbb8e5501f20872b64
Author: Martin Jambor <mjambor@suse.cz>
Date:   Sat Mar 9 00:47:22 2024 +0100

    ipa: Avoid excessive removing of SSAs (PR 113757)

    PR 113757 shows that the code which was meant to debug-reset and
    remove SSAs defined by LHSs of calls redirected to
    __builtin_unreachable can trigger also when speculative
    devirtualization creates a call to a noreturn function (and since it
    is noreturn, it does not bother dealing with its return value).

    What is more, it seems that the code handling this case is not really
    necessary.  I feel slightly idiotic about this because I have a
    feeling that I added it because of a failing test-case but I can
    neither find the testcase nor a reason why the code in
    cgraph_edge::redirect_call_stmt_to_callee would not be sufficient (it
    turns the SSA name into a default-def, a bit like IPA-SRA, but any
    code dominated by a call to a noreturn is not dangerous when it comes
    to its side-effects).  So this patch just removes the handling.

    gcc/ChangeLog:

    2024-02-07  Martin Jambor  <mjambor@suse.cz>

            PR ipa/113757
            * tree-inline.cc (redirect_all_calls): Remove code adding SSAs to
            id->killed_new_ssa_names.

    gcc/testsuite/ChangeLog:

    2024-02-07  Martin Jambor  <mjambor@suse.cz>

            PR ipa/113757
            * g++.dg/ipa/pr113757.C: New test.

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0 since r14-8398

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0 since r14-8398

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

--- Comment #11 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Martin Jambor
<jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:40ddc0b05a47f999b24f20c1becb79004995731b

commit r13-8594-g40ddc0b05a47f999b24f20c1becb79004995731b
Author: Martin Jambor <mjambor@suse.cz>
Date:   Mon Apr 8 17:34:33 2024 +0200

    ipa: Self-DCE of uses of removed call LHSs (PR 108007)

    PR 108007 is another manifestation where we rely on DCE to clean-up
    after IPA-SRA and if the user explicitely switches DCE off, IPA-SRA
    can leave behind statements which are fed uninitialized values and
    trap, even though their results are themselves never used.

    I have already fixed this for unused parameters in callees, this bug
    shows that almost the same thing can happen for removed returns, on
    the side of callers.  This means that the issue has to be fixed
    elsewhere, in call redirection.  This patch adds a function which
    looks for (and through, using a work-list) uses of operations fed
    specific SSA names and removes them all.

    That would have been easy if it wasn't for debug statements during
    tree-inline (from which call redirection is also invoked).  Debug
    statements are decoupled from the rest at this point and iterating
    over uses of SSAs does not bring them up.  During tree-inline they are
    handled especially at the end, I assume in order to make sure that
    relative ordering of UIDs are the same with and without debug info.

    This means that during tree-inline we need to make a hash of killed
    SSAs, that we already have in copy_body_data, available to the
    function making the purging.  So the patch duly does also that, making
    the interface slightly ugly.  Moreover, all newly unused SSA names
    need to be freed and as PR 112616 showed, it must be done in a defined
    order, which is what newly added ipa_release_ssas_in_hash does.

    This backport to gcc-13 also contains
    54e505d0446f86b7ad383acbb8e5501f20872b64 in order not to reintroduce
    PR 113757.

    gcc/ChangeLog:

    2024-04-05  Martin Jambor  <mjambor@suse.cz>

            PR ipa/108007
            PR ipa/112616
            * cgraph.h (cgraph_edge): Add a parameter to
            redirect_call_stmt_to_callee.
            * ipa-param-manipulation.h (ipa_param_adjustments): Add a
            parameter to modify_call.
            (ipa_release_ssas_in_hash): Declare.
            * cgraph.cc (cgraph_edge::redirect_call_stmt_to_callee): New
            parameter killed_ssas, pass it to padjs->modify_call.
            * ipa-param-manipulation.cc (purge_all_uses): New function.
            (ipa_param_adjustments::modify_call): New parameter killed_ssas.
            Instead of substituting uses, invoke purge_all_uses.  If
            hash of killed SSAs has not been provided, create a temporary one
            and release SSAs that have been added to it.
            (compare_ssa_versions): New function.
            (ipa_release_ssas_in_hash): Likewise.
            * tree-inline.cc (redirect_all_calls): Create
            id->killed_new_ssa_names earlier, pass it to edge redirection,
            adjust a comment.
            (copy_body): Release SSAs in id->killed_new_ssa_names.

    gcc/testsuite/ChangeLog:

    2024-01-15  Martin Jambor  <mjambor@suse.cz>

            PR ipa/108007
            PR ipa/112616
            * gcc.dg/ipa/pr108007.c: New test.
            * gcc.dg/ipa/pr112616.c: Likewise.

    (cherry picked from commit a9a8426e534760b8d3a250e9bd3cff4db131a2be)

[Bug tree-optimization/113757] [14 regression] ICE when building legion-23.03.0 since r14-8398

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113757

--- Comment #12 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Martin Jambor
<jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:2183e5b5aa3a080624cb95a06993e34dedd09cb2

commit r12-10443-g2183e5b5aa3a080624cb95a06993e34dedd09cb2
Author: Martin Jambor <mjambor@suse.cz>
Date:   Mon Apr 8 17:34:33 2024 +0200

    ipa: Self-DCE of uses of removed call LHSs (PR 108007)

    PR 108007 is another manifestation where we rely on DCE to clean-up
    after IPA-SRA and if the user explicitely switches DCE off, IPA-SRA
    can leave behind statements which are fed uninitialized values and
    trap, even though their results are themselves never used.

    I have already fixed this for unused parameters in callees, this bug
    shows that almost the same thing can happen for removed returns, on
    the side of callers.  This means that the issue has to be fixed
    elsewhere, in call redirection.  This patch adds a function which
    looks for (and through, using a work-list) uses of operations fed
    specific SSA names and removes them all.

    That would have been easy if it wasn't for debug statements during
    tree-inline (from which call redirection is also invoked).  Debug
    statements are decoupled from the rest at this point and iterating
    over uses of SSAs does not bring them up.  During tree-inline they are
    handled especially at the end, I assume in order to make sure that
    relative ordering of UIDs are the same with and without debug info.

    This means that during tree-inline we need to make a hash of killed
    SSAs, that we already have in copy_body_data, available to the
    function making the purging.  So the patch duly does also that, making
    the interface slightly ugly.  Moreover, all newly unused SSA names
    need to be freed and as PR 112616 showed, it must be done in a defined
    order, which is what newly added ipa_release_ssas_in_hash does.

    This backport to gcc-13 also contains
    54e505d0446f86b7ad383acbb8e5501f20872b64 in order not to reintroduce
    PR 113757.

    gcc/ChangeLog:

    2024-04-05  Martin Jambor  <mjambor@suse.cz>

            PR ipa/108007
            PR ipa/112616
            * cgraph.h (cgraph_edge): Add a parameter to
            redirect_call_stmt_to_callee.
            * ipa-param-manipulation.h (ipa_param_adjustments): Add a
            parameter to modify_call.
            (ipa_release_ssas_in_hash): Declare.
            * cgraph.cc (cgraph_edge::redirect_call_stmt_to_callee): New
            parameter killed_ssas, pass it to padjs->modify_call.
            * ipa-param-manipulation.cc (purge_all_uses): New function.
            (ipa_param_adjustments::modify_call): New parameter killed_ssas.
            Instead of substituting uses, invoke purge_all_uses.  If
            hash of killed SSAs has not been provided, create a temporary one
            and release SSAs that have been added to it.
            (compare_ssa_versions): New function.
            (ipa_release_ssas_in_hash): Likewise.
            * tree-inline.cc (redirect_all_calls): Create
            id->killed_new_ssa_names earlier, pass it to edge redirection,
            adjust a comment.
            (copy_body): Release SSAs in id->killed_new_ssa_names.

    gcc/testsuite/ChangeLog:

    2024-01-15  Martin Jambor  <mjambor@suse.cz>

            PR ipa/108007
            PR ipa/112616
            * gcc.dg/ipa/pr108007.c: New test.
            * gcc.dg/ipa/pr112616.c: Likewise.

    (cherry picked from commit 40ddc0b05a47f999b24f20c1becb79004995731b)