[Bug middle-end/114048] New: [14 regression] ICE when building libowfat-0.33 on x86

[Bug middle-end/114048] New: [14 regression] ICE when building libowfat-0.33 on x86

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114048

            Bug ID: 114048
           Summary: [14 regression] ICE when building libowfat-0.33 on x86
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sjames at gcc dot gnu.org
  Target Milestone: ---

Created attachment 57490
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57490&action=edit
critbit.i

Originally reported downstream in Gentoo by Agostino Sarubbo at
https://bugs.gentoo.org/925231.

```
$ i686-pc-linux-gnu-gcc -c critbit/critbit.c -I. -O2 -march=i686 -mfpmath=sse
-msse2 -fomit-frame-pointer
during GIMPLE pass: fre
critbit/critbit.c: In function ‘allprefixed_traverse’:
critbit/critbit.c:184:12: internal compiler error: in
copy_reference_ops_from_ref, at tree-ssa-sccvn.cc:1165
  184 | static int allprefixed_traverse(uint8_t* top,int(*handle)(const
char*,void*),void* arg) {
      |            ^~~~~~~~~~~~~~~~~~~~
0x56e000cf copy_reference_ops_from_ref
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:1165
0x58665915 valueize_shared_reference_ops_from_ref
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:1858
0x58665915 vn_reference_lookup(tree_node*, tree_node*, vn_lookup_kind,
vn_reference_s**, bool, tree_node**, tree_node*, bool)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:4063
0x585da936 visit_reference_op_load
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:5852
0x585da936 visit_stmt
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:6373
0x585d43a0 process_bb
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:8145
0x585ca491 do_rpo_vn_1
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:8746
0x585ef988 execute
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:8907
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.
```

```
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/i686-pc-linux-gnu/14/lto-wrapper
Target: i686-pc-linux-gnu
Configured with:
/var/tmp/portage/sys-devel/gcc-14.0.9999/work/gcc-14.0.9999/configure
--host=i686-pc-linux-gnu --build=i686-pc-linux-gnu --prefix=/usr
--bindir=/usr/i686-pc-linux-gnu/gcc-bin/14
--includedir=/usr/lib/gcc/i686-pc-linux-gnu/14/include
--datadir=/usr/share/gcc-data/i686-pc-linux-gnu/14
--mandir=/usr/share/gcc-data/i686-pc-linux-gnu/14/man
--infodir=/usr/share/gcc-data/i686-pc-linux-gnu/14/info
--with-gxx-include-dir=/usr/lib/gcc/i686-pc-linux-gnu/14/include/g++-v14
--disable-silent-rules --disable-dependency-tracking
--with-python-dir=/share/gcc-data/i686-pc-linux-gnu/14/python
--enable-languages=c,c++,fortran --enable-obsolete --enable-secureplt
--disable-werror --with-system-zlib --enable-nls --without-included-gettext
--disable-libunwind-exceptions --enable-checking=yes,extra,rtl,df
--with-bugurl=https://bugs.gentoo.org/ --with-pkgversion='Gentoo 14.0.9999 p,
commit 568b3f9940f87a775060aea789b2f438af477e9f' --with-gcc-major-version-only
--enable-libstdcxx-time --enable-lto --disable-libstdcxx-pch --enable-shared
--enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu
--disable-multilib --disable-fixed-point --with-arch=i686 --enable-targets=all
--enable-libgomp --disable-libssp --disable-libada --disable-cet
--disable-systemtap --disable-valgrind-annotations --disable-vtable-verify
--disable-libvtv --with-zstd --without-isl --enable-default-pie
--enable-host-pie --disable-host-bind-now --enable-default-ssp
--with-build-config='bootstrap-O3 bootstrap-lto'
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.1 20240215 (experimental)
b3b3bd250f0a7c22b7d46d3522c8b94c6a35d22a (Gentoo 14.0.9999 p, commit
568b3f9940f87a775060aea789b2f438af477e9f)
```

[Bug middle-end/114048] [14 regression] ICE when building libowfat-0.33 on x86

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114048

--- Comment #1 from Sam James <sjames at gcc dot gnu.org> ---
Reducing...

[Bug middle-end/114048] [14 regression] ICE when building libowfat-0.33 on x86

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114048

--- Comment #2 from Sam James <sjames at gcc dot gnu.org> ---
Reduced:
```
typedef struct {
  void *child[2];
  char otherbits;
} critbit0_node;

int allprefixed_traverse(char *top) {
  if (top) {
    critbit0_node *q = (void *)top - 1;
    int direction = 0;
    for (;; ++direction)
      switch (allprefixed_traverse(q->child[direction])) {
      case 1:
        break;
      case 0:
        return 0;
      default:
        return 1;
      }
  }
}
```

[Bug middle-end/114048] [14 regression] ICE when building libowfat-0.33

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114048

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[14 regression] ICE when    |[14 regression] ICE when
                   |building libowfat-0.33 on   |building libowfat-0.33
                   |x86                         |

--- Comment #3 from Sam James <sjames at gcc dot gnu.org> ---
It crashes on amd64 for me too but differently:
```

$ gcc /tmp/foo.c -O2
during GIMPLE pass: fre
/tmp/foo.c: In function ‘allprefixed_traverse’:
/tmp/foo.c:6:5: internal compiler error: in copy_reference_ops_from_ref, at
tree-ssa-sccvn.cc:1185
    6 | int allprefixed_traverse(char *top) {
      |     ^~~~~~~~~~~~~~~~~~~~
0x55da5656e87d copy_reference_ops_from_ref
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:1185

/tmp/foo.c:6:5: internal compiler error: Segmentation fault
0x55da5700a7f6 crash_signal
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/toplev.cc:317
0x55da582ff8d7 x86_64_fallback_frame_state
        ./md-unwind-support.h:63
0x55da582ff8d7 uw_frame_state_for
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/libgcc/unwind-dw2.c:1013
0x55da583009fd _Unwind_Backtrace
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/libgcc/unwind.inc:303
0x55da57773aa8 backtrace_full
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/libbacktrace/backtrace.c:127
0x55da561080dd diagnostic_context::action_after_output(diagnostic_t)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/diagnostic.cc:781
0x55da5785edeb diagnostic_action_after_output(diagnostic_context*,
diagnostic_t)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/diagnostic.h:1002
0x55da5785edeb diagnostic_context::report_diagnostic(diagnostic_info*)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/diagnostic.cc:1633
0x55da57fa21e8 diagnostic_impl
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/diagnostic.cc:1767
0x55da5773d17f internal_error(char const*, ...)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/diagnostic.cc:2225
0x55da57714254 fancy_abort(char const*, int, char const*)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/diagnostic.cc:2336
0x55da5656e87d copy_reference_ops_from_ref
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:1185
```

and w/ valgrind:
```
$ gcc /tmp/foo.c -O2 -wrapper valgrind
==2895261== Memcheck, a memory error detector
==2895261== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==2895261== Using Valgrind-3.23.0.GIT and LibVEX; rerun with -h for copyright
info
==2895261== Command: /usr/libexec/gcc/x86_64-pc-linux-gnu/14/cc1 -quiet
/tmp/foo.c -quiet -dumpdir a- -dumpbase foo.c -dumpbase-ext .c -mtune=generic
-march=x86-64 -O2 -o /tmp/cc89yYYR.s
==2895261==
during GIMPLE pass: fre
/tmp/foo.c: In function ‘allprefixed_traverse’:
/tmp/foo.c:6:5: internal compiler error: in copy_reference_ops_from_ref, at
tree-ssa-sccvn.cc:1185
    6 | int allprefixed_traverse(char *top) {
      |     ^~~~~~~~~~~~~~~~~~~~
0x7c787d copy_reference_ops_from_ref
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/tree-ssa-sccvn.cc:1185
==2895261== Invalid read of size 1
==2895261==    at 0x25588D7: x86_64_fallback_frame_state
(md-unwind-support.h:63)
==2895261==    by 0x25588D7: uw_frame_state_for (unwind-dw2.c:1013)
==2895261==    by 0x25599FD: _Unwind_Backtrace (unwind.inc:303)
==2895261==    by 0x19CCAA8: backtrace_full (backtrace.c:127)
==2895261==    by 0x3610DD:
diagnostic_context::action_after_output(diagnostic_t) [clone .cold]
(diagnostic.cc:781)
==2895261==    by 0x1AB7DEB: UnknownInlinedFun (diagnostic.h:1002)
==2895261==    by 0x1AB7DEB:
diagnostic_context::report_diagnostic(diagnostic_info*) (diagnostic.cc:1633)
==2895261==    by 0x21FB1E8: diagnostic_impl(rich_location*,
diagnostic_metadata const*, int, char const*, __va_list_tag (*) [1],
diagnostic_t) [clone .lto_priv.0] (diagnostic.cc:1767)
==2895261==    by 0x199617F: internal_error(char const*, ...)
(diagnostic.cc:2225)
==2895261==    by 0x196D254: fancy_abort(char const*, int, char const*)
(diagnostic.cc:2336)
==2895261==    by 0x7C787D: copy_reference_ops_from_ref(tree_node*,
vec<vn_reference_op_struct, va_heap, vl_ptr>*) [clone .lto_priv.0] [clone
.cold] (tree-ssa-sccvn.cc:1185)
==2895261==  Address 0x864f60e8d98948 is not stack'd, malloc'd or (recently)
free'd
==2895261==

/tmp/foo.c:6:5: internal compiler error: Segmentation fault

```

[Bug middle-end/114048] [14 Regression] ICE when building libowfat-0.33 since r14-8929

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114048

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[14 regression] ICE when    |[14 Regression] ICE when
                   |building libowfat-0.33      |building libowfat-0.33
                   |                            |since r14-8929
     Ever confirmed|0                           |1
           Priority|P3                          |P1
   Target Milestone|---                         |14.0
             Status|UNCONFIRMED                 |NEW
                 CC|                            |jakub at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
   Last reconfirmed|                            |2024-02-22

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Both with the -m32 -O2 -march=i686 -mfpmath=sse -msse2 -fomit-frame-pointer and
-m64 -O2 options this started to ICE with
r14-8929-g938a419182f8c43bd1212ffb98f8aa6077cf8326

[Bug middle-end/114048] [14 Regression] ICE when building libowfat-0.33 since r14-8929

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114048

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.

[Bug middle-end/114048] [14 Regression] ICE when building libowfat-0.33 since r14-8929

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114048

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
index 3e93685e80a..2587eb1c505 100644
--- a/gcc/tree-ssa-sccvn.cc
+++ b/gcc/tree-ssa-sccvn.cc
@@ -1185,6 +1185,8 @@ copy_reference_ops_from_ref (tree ref,
vec<vn_reference_op_s> *result)
              else
                {
                  gcc_assert (known_ne (op.off, -1)
+                             /* The constant offset can be -1.  */
+                             || op.opcode == MEM_REF
                              /* Out-of-bound indices can compute to
                                 a known -1 offset.  */
                              || ((op.opcode == ARRAY_REF

[Bug middle-end/114048] [14 Regression] ICE when building libowfat-0.33 since r14-8929

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114048

--- Comment #7 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:92c40297991f51e7fa942f29517bc4398fce33f9

commit r14-9135-g92c40297991f51e7fa942f29517bc4398fce33f9
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Feb 22 14:22:29 2024 +0100

    tree-optimization/114048 - ICE in copy_reference_ops_from_ref

    The following adds another omission to the assert verifying we're
    not running into spurious off == -1.

            PR tree-optimization/114048
            * tree-ssa-sccvn.cc (copy_reference_ops_from_ref): MEM_REF
            can also produce -1 off.

            * gcc.dg/torture/pr114048.c: New testcase.

[Bug middle-end/114048] [14 Regression] ICE when building libowfat-0.33 since r14-8929

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114048

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.