[Bug tree-optimization/113898] New: ICE in copy_reference_ops_from_ref, at tree-ssa-sccvn.cc:1156

[Bug tree-optimization/113898] New: ICE in copy_reference_ops_from_ref, at tree-ssa-sccvn.cc:1156

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113898

            Bug ID: 113898
           Summary: ICE in copy_reference_ops_from_ref, at
                    tree-ssa-sccvn.cc:1156
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shaohua.li at inf dot ethz.ch
                CC: rguenth at gcc dot gnu.org
  Target Milestone: ---

gcc at -Os crashed on the test case.

Bisected to r14-8929-g938a419182f


%cat reduced.c
int a, d;
unsigned **b;
long c, f;
long e[2][1];
void g() {
  int h = 0;
  for (; h < 2; h++) {
    e[h][d + **b + a] = c;
    if (f)
      for (;;)
        ;
  }
}
void main() {}
%
%gcc -Os reduced.c
int a, d;
unsigned **b;
long c, f;
long e[2][1];
void g() {
  int h = 0;
  for (; h < 2; h++) {
    e[h][d + **b + a] = c;
    if (f)
      for (;;)
        ;
  }
}
void main() {}
%

[Bug tree-optimization/113898] [14 regression] ICE in copy_reference_ops_from_ref, at tree-ssa-sccvn.cc:1156 since r14-8929-g938a419182f

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113898

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2024-02-13
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
     Ever confirmed|0                           |1
   Target Milestone|---                         |14.0

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Looking.

[Bug tree-optimization/113898] [14 regression] ICE in copy_reference_ops_from_ref, at tree-ssa-sccvn.cc:1156 since r14-8929-g938a419182f

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113898

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
<bb 3> [local count: 101363582]:
# RANGE [irange] int [1, 2]
h_24 = 1;
ivtmp_25 = 1;
e[h_24][_9] = c.5_10;

so there's a missed CCP (this is late FRE).  We massaged it to e[1][1] but
it should have been e[1][0] instead.

Oops.  Testing fix.

[Bug tree-optimization/113898] [14 regression] ICE in copy_reference_ops_from_ref, at tree-ssa-sccvn.cc:1156 since r14-8929-g938a419182f

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113898

--- Comment #3 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:af6d8d0cc1ac56eba55ef658c664236208f88169

commit r14-8950-gaf6d8d0cc1ac56eba55ef658c664236208f88169
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Feb 13 10:04:31 2024 +0100

    tree-optimization/113898 - ICE with sanity checking for VN ref adjustment

    The following fixes a missing add to the accumulated offset when
    adjusting an ARRAY_REF op for value-ranges applied to by
    get_ref_base_and_extent.

            PR tree-optimization/113898
            * tree-ssa-sccvn.cc (copy_reference_ops_from_ref): Add
            missing accumulated off adjustment.

            * gcc.dg/torture/pr113898.c: New testcase.

[Bug tree-optimization/113898] [14 regression] ICE in copy_reference_ops_from_ref, at tree-ssa-sccvn.cc:1156 since r14-8929-g938a419182f

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113898

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
This one is fixed now.

[Bug tree-optimization/113898] [14 regression] ICE in copy_reference_ops_from_ref, at tree-ssa-sccvn.cc:1156 since r14-8929-g938a419182f

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113898

Shaohua Li <shaohua.li at inf dot ethz.ch> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |---

--- Comment #5 from Shaohua Li <shaohua.li at inf dot ethz.ch> ---
Looks like the fix is not complete

Compiler explorer: https://godbolt.org/z/z3YKznMzE

% cat reduced.c
long a, b, c;
int d;
long e[2][1];
int f() {
  if (c == a)
    c = b;
}
void g() {
  int h, i = 0;
  for (; f() + d + i; i++)
    e[h][i] = 4;
}
void main() {}
%
% gcc -O3 reduced.c
during GIMPLE pass: fre
reduced.c: In function 'g':
reduced.c:8:6: internal compiler error: in copy_reference_ops_from_ref, at
tree-ssa-sccvn.cc:1177
    8 | void g() {
      |      ^
0x233ba2c internal_error(char const*, ...)
        ???:0
0x96c20f fancy_abort(char const*, int, char const*)
        ???:0
0x12991ba vn_reference_lookup(tree_node*, tree_node*, vn_lookup_kind,
vn_reference_s**, bool, tree_node**, tree_node*, bool)
        ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
Compiler returned: 1
%

[Bug tree-optimization/113898] [14 regression] ICE in copy_reference_ops_from_ref, at tree-ssa-sccvn.cc:1156 since r14-8929-g938a419182f

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113898

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Yes, that case is tracked in PR113895 - we value number

e[h_7(D)][1] = 4;

and out-of-bound array indices behave differently, choking the verifier code.
And I don't see an easy way to fix that so the plan is to remove the verifier
code (not sure if it's worth detecting those cases and selectively
disabling it).

Let's track this in the other bug.