[Bug tree-optimization/115149] New: ICE on valid code at -O3 with "-fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch" on x86_64-linux-gnu: verify_ssa failed

[Bug tree-optimization/115149] New: ICE on valid code at -O3 with "-fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch" on x86_64-linux-gnu: verify_ssa failed

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115149

            Bug ID: 115149
           Summary: ICE on valid code at -O3 with "-fno-inline
                    -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch"
                    on x86_64-linux-gnu: verify_ssa failed
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

This appears to be a recent regression as it doesn't reproduce with 14.1 and
earlier.

Compiler Explorer: https://godbolt.org/z/xGfY5vofe

[729] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/15.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 15.0.0 20240516 (experimental) (GCC) 
[730] % 
[730] % gcctk -O3 -fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce
-fno-tree-ch small.c
small.c: In function ‘main’:
small.c:4:5: error: stmt with wrong VUSE
    4 | int main() {
      |     ^~~~
# VUSE <.MEM_16(D)>
c_lsm.18_25 = c;
expected .MEM_17
during GIMPLE pass: sink
small.c:4:5: internal compiler error: verify_ssa failed
0x140abbe verify_ssa(bool, bool)
        ../../gcc-trunk/gcc/tree-ssa.cc:1203
0x102ded5 execute_function_todo
        ../../gcc-trunk/gcc/passes.cc:2096
0x102e73e execute_todo
        ../../gcc-trunk/gcc/passes.cc:2143
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[731] % 
[731] % cat small.c
int a, c, e, f, g, h[1], i;
static int j(int b) { return 0; }
static void k(int d) {}
int main() {
  if (h[0])
    while (1) {
      k(f && j(i && (h[g] = e)));
      while (a)
        c ^= 1;
    }
  return 0;
}

[Bug tree-optimization/115149] [15 Regression] ICE on valid code at -O3 with "-fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch" on x86_64-linux-gnu: verify_ssa failed

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115149

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |15.0
            Summary|ICE on valid code at -O3    |[15 Regression] ICE on
                   |with "-fno-inline           |valid code at -O3 with
                   |-fno-tree-vrp -fno-ipa-sra  |"-fno-inline -fno-tree-vrp
                   |-fno-tree-dce -fno-tree-ch" |-fno-ipa-sra -fno-tree-dce
                   |on x86_64-linux-gnu:        |-fno-tree-ch" on
                   |verify_ssa failed           |x86_64-linux-gnu:
                   |                            |verify_ssa failed
           Keywords|                            |ice-on-valid-code
            Version|unknown                     |15.0

[Bug tree-optimization/115149] [15 Regression] ICE on valid code at -O3 with "-fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch" on x86_64-linux-gnu: verify_ssa failed

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115149

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2024-05-21
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed. We are sinking the load of c back into the (infinite) loop and not
updating the vuse here.

[Bug tree-optimization/115149] [15 Regression] ICE on valid code at -O3 with "-fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch" on x86_64-linux-gnu: verify_ssa failed

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115149

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.

[Bug tree-optimization/115149] [15 Regression] ICE on valid code at -O3 with "-fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch" on x86_64-linux-gnu: verify_ssa failed

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115149

--- Comment #3 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ec9b8bafe20755d13ab9a1b834b5da79ae972c0e

commit r15-750-gec9b8bafe20755d13ab9a1b834b5da79ae972c0e
Author: Richard Biener <rguenther@suse.de>
Date:   Tue May 21 09:48:04 2024 +0200

    tree-optimization/115149 - VOP live and missing PHIs

    The following fixes a bug in vop-live get_live_in which was using
    NULL to indicate the first processed edge but at the same time
    using it for the case the live-in virtual operand cannot be computed.
    The following fixes this, avoiding sinking a load to a place where
    we'd have to insert virtual PHIs to make the virtual operand SSA
    web OK.

            PR tree-optimization/115149
            * tree-ssa-live.cc (virtual_operand_live::get_live_in):
            Explicitly track the first processed edge.

            * gcc.dg/pr115149.c: New testcase.

[Bug tree-optimization/115149] [14 Regression] ICE on valid code at -O3 with "-fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch" on x86_64-linux-gnu: verify_ssa failed

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115149

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |15.0
   Target Milestone|15.0                        |14.2
            Summary|[15 Regression] ICE on      |[14 Regression] ICE on
                   |valid code at -O3 with      |valid code at -O3 with
                   |"-fno-inline -fno-tree-vrp  |"-fno-inline -fno-tree-vrp
                   |-fno-ipa-sra -fno-tree-dce  |-fno-ipa-sra -fno-tree-dce
                   |-fno-tree-ch" on            |-fno-tree-ch" on
                   |x86_64-linux-gnu:           |x86_64-linux-gnu:
                   |verify_ssa failed           |verify_ssa failed

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
OK, so the issue is that the endless loop is a CFG sink that doesn't enforce a
VUSE so we "miss" virtual PHIs in BB 13 and BB 14 and that makes sinking
think it doesn't need to update VOPs.  This is a latent issue and IMO
a design bug of the virtual SSA net.  sinking now employs VOP_LIVE but
even that doesn't handle this situation because of a bug.  I'm testing a fix.

Fixed on trunk, queued for backporting.

[Bug tree-optimization/115149] [14 Regression] ICE on valid code at -O3 with "-fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch" on x86_64-linux-gnu: verify_ssa failed

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115149

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/115149] [14 Regression] ICE on valid code at -O3 with "-fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch" on x86_64-linux-gnu: verify_ssa failed

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115149

--- Comment #5 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-14 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:90a447677a2abb934b683a012b477e6c52088e35

commit r14-10257-g90a447677a2abb934b683a012b477e6c52088e35
Author: Richard Biener <rguenther@suse.de>
Date:   Tue May 21 09:48:04 2024 +0200

    tree-optimization/115149 - VOP live and missing PHIs

    The following fixes a bug in vop-live get_live_in which was using
    NULL to indicate the first processed edge but at the same time
    using it for the case the live-in virtual operand cannot be computed.
    The following fixes this, avoiding sinking a load to a place where
    we'd have to insert virtual PHIs to make the virtual operand SSA
    web OK.

            PR tree-optimization/115149
            * tree-ssa-live.cc (virtual_operand_live::get_live_in):
            Explicitly track the first processed edge.

            * gcc.dg/pr115149.c: New testcase.

    (cherry picked from commit ec9b8bafe20755d13ab9a1b834b5da79ae972c0e)

[Bug tree-optimization/115149] [14 Regression] ICE on valid code at -O3 with "-fno-inline -fno-tree-vrp -fno-ipa-sra -fno-tree-dce -fno-tree-ch" on x86_64-linux-gnu: verify_ssa failed

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115149

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.