[Bug middle-end/114624] New: ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[Bug middle-end/114624] New: ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114624

            Bug ID: 114624
           Summary: ICE on valid code at -O3 on x86_64-linux-gnu:
                    Segmentation fault
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

This appears to be a recent regression.

Compiler Explorer: https://godbolt.org/z/neef45W14

[516] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/14.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.1 20240405 (experimental) (GCC)
[517] %
[517] % gcctk -O3 small.c
during GIMPLE pass: sccp
small.c: In function ‘main’:
small.c:2:5: internal compiler error: Segmentation fault
    2 | int main() {
      |     ^~~~
0x116b653 crash_signal
        ../../gcc-trunk/gcc/toplev.cc:319
0x7fe51d50a08f ???
       
/build/glibc-wuryBv/glibc-2.31/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
0x249ec06 get_data_from_adhoc_loc(line_maps const*, unsigned int)
        ../../gcc-trunk/libcpp/line-map.cc:297
0x11b8216 verify_location
        ../../gcc-trunk/gcc/tree-cfg.cc:5384
0x11bc50f verify_gimple_in_cfg(function*, bool, bool)
        ../../gcc-trunk/gcc/tree-cfg.cc:5600
0x10292b4 execute_function_todo
        ../../gcc-trunk/gcc/passes.cc:2089
0x1029c0e execute_todo
        ../../gcc-trunk/gcc/passes.cc:2143
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[518] %
[518] % cat small.c
int a, b;
int main() {
  int c, d = 1;
  while (a) {
    while (b)
      if (d)
        while (a)
          ;
    for (; b < 2; b++)
      if (b)
        for (c = 0; c < 8; c++)
          d = 0;
      else
        for (a = 0; a < 2; a++)
          ;
  }
  return 0;
}

[Bug tree-optimization/114624] [14 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114624

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|ICE on valid code at -O3 on |[14 Regression] ICE on
                   |x86_64-linux-gnu:           |valid code at -O3 on
                   |Segmentation fault          |x86_64-linux-gnu:
                   |                            |Segmentation fault
           Keywords|                            |needs-bisection
   Target Milestone|---                         |14.0
            Version|unknown                     |14.0
          Component|middle-end                  |tree-optimization

[Bug tree-optimization/114624] [14 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114624

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-04-07
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed. It does not ICE with `-fno-checking` but does also ICE with
`-fdump-tree-sccp-lineno` too; it also crashes with -g (though later on).


I think it is crashing on:
```
d_9 = d_30;

```

statement.

[Bug tree-optimization/114624] [14 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114624

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|ice-checking                |

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Removing `ice-checking` because you can get it to crash even without checking
enabled.

[Bug tree-optimization/114624] [14 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114624

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.

[Bug tree-optimization/114624] [14 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114624

--- Comment #4 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:97d5cd8740384dbce5a83080916388f80d8976dd

commit r14-9829-g97d5cd8740384dbce5a83080916388f80d8976dd
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Apr 8 10:38:49 2024 +0200

    tree-optimization/114624 - fix use-after-free in SCCP

    We're inspecting the replaced PHI node after releasing it.

            PR tree-optimization/114624
            * tree-scalar-evolution.cc (final_value_replacement_loop):
            Get at the PHI arg location before releasing the PHI node.

            * gcc.dg/torture/pr114624.c: New testcase.

[Bug tree-optimization/114624] [14 Regression] ICE on valid code at -O3 on x86_64-linux-gnu: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114624

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.