[Bug tree-optimization/116352] New: [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188)

[Bug tree-optimization/116352] New: [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

            Bug ID: 116352
           Summary: [15 regression] ICE when building opencv-4.9.0 (error:
                    definition in block 208 does not dominate use in block
                    188)
           Product: gcc
           Version: 15.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sjames at gcc dot gnu.org
  Target Milestone: ---

Created attachment 58917
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58917&action=edit
prior_box_layer.cpp.ii.xz

```
$ g++ -c
../opencv-4.9.0_build-abi_x86_64.amd64-python3_12/modules/dnn/CMakeFiles/opencv_dnn.dir/src/layers/prior_box_layer.cpp.ii
-march=znver3 -O3
/var/tmp/portage/media-libs/opencv-4.9.0-r1/work/opencv-4.9.0/modules/dnn/src/layers/prior_box_layer.cpp:
In member function ‘virtual void
cv::dnn::PriorBoxLayerImpl::forward(cv::InputArrayOfArrays,
cv::OutputArrayOfArrays, cv::OutputArrayOfArrays)’:
/var/tmp/portage/media-libs/opencv-4.9.0-r1/work/opencv-4.9.0/modules/dnn/src/layers/prior_box_layer.cpp:426:10:
error: definition in block 208 does not dominate use in block 188
  426 |     void forward(InputArrayOfArrays inputs_arr, OutputArrayOfArrays
outputs_arr, OutputArrayOfArrays internals_arr) CV_OVERRIDE
      |          ^~~~~~~
for SSA_NAME: _1178 in statement:
vect__976.1441_664 = _1094 + _1178;
during GIMPLE pass: slp
/var/tmp/portage/media-libs/opencv-4.9.0-r1/work/opencv-4.9.0/modules/dnn/src/layers/prior_box_layer.cpp:426:10:
internal compiler error: verify_ssa failed
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
See <https://bugs.gentoo.org/> for instructions.
```

```
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-pc-linux-gnu/15/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with:
/var/tmp/portage/sys-devel/gcc-15.0.9999/work/gcc-15.0.9999/configure
--host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --prefix=/usr
--bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/15
--includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/15/include
--datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/15
--mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/15/man
--infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/15/info
--with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/15/include/g++-v15
--disable-silent-rules --disable-dependency-tracking
--with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/15/python
--enable-languages=c,c++,fortran --enable-obsolete --enable-secureplt
--disable-werror --with-system-zlib --enable-nls --without-included-gettext
--disable-libunwind-exceptions --enable-checking=yes,extra,rtl
--with-bugurl=https://bugs.gentoo.org/ --with-pkgversion='Gentoo 15.0.9999 p,
commit 743578d0de067c87f590c9886f14961bb429c1f4' --with-gcc-major-version-only
--enable-libstdcxx-time --enable-lto --disable-libstdcxx-pch --enable-shared
--enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu
--enable-multilib --with-multilib-list=m32,m64 --disable-fixed-point
--enable-targets=all --enable-libgomp --disable-libssp --disable-libada
--enable-cet --disable-systemtap --disable-valgrind-annotations
--disable-vtable-verify --disable-libvtv --with-zstd --without-isl
--enable-default-pie --enable-host-pie --enable-host-bind-now
--enable-default-ssp --disable-fixincludes --with-build-config='bootstrap-O3
bootstrap-lto bootstrap-cet'
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 15.0.0 20240812 (experimental)
7a970bd03f1d8eed7703db8a8db3c753ea68899f (Gentoo 15.0.9999 p, commit
743578d0de067c87f590c9886f14961bb429c1f4)
```

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |15.0
           Keywords|                            |ice-on-valid-code

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #1 from Sam James <sjames at gcc dot gnu.org> ---
Reduced:
```
struct {
  int operator[](long);
} _boxWidths, _boxHeights;
bool _bboxesNormalized;
float _stepX, _stepY;
float *forward___trans_tmp_1, *forward_outputPtr;
void forward() {
  float _boxWidth, _boxHeight;
  _boxWidth = _boxWidths[0];
  _boxHeight = _boxHeights[0];
  for (int j; j; ++j) {
    float center_x = 0 * _stepX, center_y = 0 * _stepY, imgHeight, imgWidth;
    float *dst = forward_outputPtr;
    if (_bboxesNormalized) {
      dst[0] = dst[1] = (center_y - _boxHeight * 0.5f) / imgHeight;
      dst[2] = (center_x + _boxWidth * 0.5f) / imgWidth;
      dst[3] = (center_y + _boxHeight * 0.5f) / imgHeight;
    } else
      dst[2] = _boxWidth * 0.5f + _boxHeight * 0.5f;
    forward___trans_tmp_1 = forward_outputPtr + 4;
    forward_outputPtr = forward___trans_tmp_1;
  }
}
```

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #2 from Sam James <sjames at gcc dot gnu.org> ---
Cleaned up:
```
int a, f, g;
float b, c;
float *d, *e;
void l(int h) {
  for (; h; ++h) {
    float i = 0 * b, j = 0 * c;
    float *k = e;
    if (a) {
      k[0] = k[1] = (j - g * 0.5f) / 1;
      k[2] = (i + f * 0.5f) / 1;
      k[3] = (j + g * 0.5f) / 1;
    } else
      k[1] = f * 0.5f + g * 0.5f;
    d = e + 4;
    e = d;
  }
}
```

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed, slightly reduced with some more clean up (loop is now closer to be
finite):
```
int a;
float b, c;
void l(int h, int f, int g, float *e)
{
  for (int m = 0; m < h; m++)
  {
    float i = 2 * b, j = 2 * c;
    if (a) {
      e[m*4 + 0] = e[m*4 + 1] = (j - g * 0.5f);
      e[m*4 + 2] = e[m*4 + 3] = (i + f * 0.5f);
    } else
      e[m*4 + 0] = f * 0.5f + g * 0.5f;
  }
}
```

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2024-08-13
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
.

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note the reduced testcase only need `-O3` .

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|x86_64-linux-gnu            |x86_64-linux-gnu
                   |                            |aarch64-linux-gnu

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
This also ICEs in the same way on aarch64 with `-O3 -fno-vect-cost-model ` but
it does not ICE when SVE is enabled because it looks like SVE can loop
vectorize the loop rather than just SLP vectorizing.

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |cmuellner at gcc dot gnu.org,
                   |                            |ptomsich at gcc dot gnu.org,
                   |                            |tsamismanolis at gmail dot com
            Summary|[15 regression] ICE when    |[15 regression] ICE when
                   |building opencv-4.9.0       |building opencv-4.9.0
                   |(error: definition in block |(error: definition in block
                   |208 does not dominate use   |208 does not dominate use
                   |in block 188)               |in block 188) since
                   |                            |r15-2820-gab18785840d7b8

--- Comment #7 from Sam James <sjames at gcc dot gnu.org> ---
r15-2820-gab18785840d7b8

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #8 from Sam James <sjames at gcc dot gnu.org> ---
Manolis et al., is this one on your list? Sorry to nag, it's just a package
with a lot of reverse dependencies.

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[tsamismanolis at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #9 from Manolis Tsamis <tsamismanolis at gmail dot com> ---
(In reply to Sam James from comment #8)
> Manolis et al., is this one on your list? Sorry to nag, it's just a package
> with a lot of reverse dependencies.

Hi Sam, yes, with the ifcvt issue now resolved, this is the thing I'm working
on right now.

Thanks and sorry for the delay.

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #10 from Sam James <sjames at gcc dot gnu.org> ---
No problem at all! I know it's been a very busy few weeks -- I just wanted to
make sure it wasn't buried in the emails, rather than needing it fixed right
now.

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[tsamismanolis at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #11 from Manolis Tsamis <tsamismanolis at gmail dot com> ---
Here's an outline of the involved BBs and the statement that causes the error:

;;   basic block 32, loop depth 0
;;    prev block 35, next block 5
;;    pred:       35 [89.4% (guessed)]
  ...
  c.1_182 = cD.2798;
  b.0_187 = bD.2797;
  ...

;;   basic block 38, loop depth 0
;;    prev block 37, next block 33
;;    pred:       37 [66.7% (guessed)]
  ...
  i_159 = b.0_187 * 2.0e+0;
  j_160 = c.1_182 * 2.0e+0;
  _119 = {j_160, _75, i_159, _73};
  _80 = VEC_PERM_EXPR <_119, _119, { 1, 1, 3, 3 }>;
  _150 = VEC_PERM_EXPR <_119, _119, { 0, 0, 2, 2 }>;
  vect__170.26_17 = _150 + _80;
  vect__164.25_16 = _150 - _80;
  ...

;;   basic block 29, loop depth 1, count 95563020 (estimated locally, freq
0.8091), maybe hot
;;    prev block 33, next block 30, flags: (NEW, VISITED)
;;    pred:       33 [always]  count:10511932 (estimated locally, freq 0.0890)
(FALLTHRU,EXECUTABLE)
;;                30 [always]  count:85051088 (estimated locally, freq 0.7201)
(FALLTHRU,DFS_BACK,EXECUTABLE)
  ...
  b.0_125 = bD.2797;
  c.1_126 = cD.2798;
  ...
  i_131 = b.0_125 * 2.0e+0;
  j_132 = c.1_126 * 2.0e+0;
  _21 = {j_132, _75, i_131, _73};
  _22 = VEC_PERM_EXPR <_21, _21, { 0, 0, 2, 2 }>;
  vect__142.30_1 = _22 + _80;
  vect__136.29_65 = _22 - _80;  # _80 is defined in <bb 38> but <bb 38> doesn't
dominate this block.
  ...

I looked at how _80 ends up in <bb 29> and it is due to caching through
bst_map. An SLP tree that corresponds to LHS = VEC_PERM_EXPR <_21, _21, { 1, 1,
3, 3 }>; would be emitted, but because it has the same effective scalar
statements (_75, _75 _73, _73) it is replaced with _80.

This happens during vect_optimize_slp, throught vect_cse_slp_nodes:

  /* Apply CSE again to nodes after permute optimization.  */
  scalar_stmts_to_slp_tree_map_t *bst_map
    = new scalar_stmts_to_slp_tree_map_t ();

  for (auto inst : vinfo->slp_instances)
    vect_cse_slp_nodes (bst_map, SLP_INSTANCE_TREE (inst));

  release_scalar_stmts_to_slp_tree_map (bst_map);

 In this case vinfo->slp_instances has multiple entries and they correspond to
multiple BBs (as seen above). The caching code uses a single bst_map instance
and vect_cse_slp_nodes doesn't have any checks for the BB in question. Due to
this, this looks like a general caching bug to me, that just happens to trigger
here after r15-2820-gab18785840d7b8 (except of course if I'm missing
something). We allow replacing nodes between BBs without checking if that would
be fine.

I'm not sure about that, but if a single slp_instance is guaranteed to affect a
single BB, we could use a bst_map per instance as a solution (in this case this
solves the issue, but I want to be sure we address the underlying problem too).

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[konstantinos.eleftheriou at vrull dot eu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #12 from Konstantinos Eleftheriou <konstantinos.eleftheriou at vrull dot eu> ---
How can I reproduce this on aarch64? I tried using the code in comment 3, using
`-O3 -fno-vect-cost-model` with SVE disabled as Andrew mentioned and GCC on
commit 7a970bd03f1d8eed7703db8a8db3c753ea68899f, but couldn't manage to
reproduce it.

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-bisection

--- Comment #13 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Konstantinos Eleftheriou from comment #12)
> How can I reproduce this on aarch64? I tried using the code in comment 3,
> using `-O3 -fno-vect-cost-model` with SVE disabled as Andrew mentioned and
> GCC on commit 7a970bd03f1d8eed7703db8a8db3c753ea68899f, but couldn't manage
> to reproduce it.

Looks like it was fixed ...

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #14 from rguenther at suse dot de <rguenther at suse dot de> ---
On Wed, 11 Sep 2024, pinskia at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352
> 
> Andrew Pinski <pinskia at gcc dot gnu.org> changed:
> 
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>            Keywords|                            |needs-bisection
> 
> --- Comment #13 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
> (In reply to Konstantinos Eleftheriou from comment #12)
> > How can I reproduce this on aarch64? I tried using the code in comment 3,
> > using `-O3 -fno-vect-cost-model` with SVE disabled as Andrew mentioned and
> > GCC on commit 7a970bd03f1d8eed7703db8a8db3c753ea68899f, but couldn't manage
> > to reproduce it.
> 
> Looks like it was fixed ...

I don't think so but it might have become latent.

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

--- Comment #15 from Sam James <sjames at gcc dot gnu.org> ---
Note that the original still fails on trunk.

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |needs-reduction

--- Comment #16 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
rereducing then ...

[Bug tree-optimization/116352] [15 regression] ICE when building opencv-4.9.0 (error: definition in block 208 does not dominate use in block 188) since r15-2820-gab18785840d7b8

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116352

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-reduction             |

--- Comment #17 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
New reduced testcase:
```
static void addPrior(float center_x, float center_y, float width, float height,
                     bool normalized, float *dst) {
  if (normalized) {
    dst[0] = (center_x - width * 0.5f);
    dst[1] = (center_y - height * 0.5f);
    dst[2] = (center_x + width * 0.5f);
    dst[3] = (center_y + height * 0.5f);
  } else {
    dst[0] = center_x - width * 0.5f;
    dst[1] = center_y - height * 0.5f;
    dst[2] = center_x + width * 0.5f - 1.0f;
    dst[3] = center_y + height * 0.5f - 1.0f;
  }
}
void forward(float *outputPtr, int _offsetsXs, float *_offsetsX,
             float *_offsetsY, float _stepX, float _stepY,
             bool _bboxesNormalized, float _boxWidth, float _boxHeight) {
  for (int j = 0; j < _offsetsXs; ++j) {
    float center_x = (_offsetsX[j]) * _stepX;
    float center_y = (_offsetsY[j]) * _stepY;
    addPrior(center_x, center_y, _boxWidth, _boxHeight, _bboxesNormalized,
             outputPtr);
    outputPtr += 4;
  }
}
```

This is almost the same as the original source even, I even added back part of
addPrior just in case though I split the increment of the outputPtr from
addPrior into the forward function.