[Bug tree-optimization/116380] New: ICE on valid code at -O3 with "-fno-tree-scev-cprop" on x86_64-linux-gnu: Segmentation fault

[Bug tree-optimization/116380] New: ICE on valid code at -O3 with "-fno-tree-scev-cprop" on x86_64-linux-gnu: Segmentation fault

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116380

            Bug ID: 116380
           Summary: ICE on valid code at -O3 with "-fno-tree-scev-cprop"
                    on x86_64-linux-gnu: Segmentation fault
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

It appears to be a regression from 12.*, and affects 13.* and later. 

Compiler Explorer: https://godbolt.org/z/bvq6qbf4n


[516] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/15.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 15.0.0 20240815 (experimental) (GCC) 
[517] % 
[517] % gcctk -O3 -fno-tree-scev-cprop small.c
during GIMPLE pass: ldist
small.c: In function ‘main’:
small.c:2:5: internal compiler error: Segmentation fault
    2 | int main() {
      |     ^~~~
0x2505c05 internal_error(char const*, ...)
        ../../gcc-trunk/gcc/diagnostic-global-context.cc:491
0x119da33 crash_signal
        ../../gcc-trunk/gcc/toplev.cc:321
0x7f1ecfbec08f ???
       
/build/glibc-LcI20x/glibc-2.31/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
0x13358d1 find_uses_to_rename_use
        ../../gcc-trunk/gcc/tree-ssa-loop-manip.cc:414
0x13358d1 find_uses_to_rename_bb
        ../../gcc-trunk/gcc/tree-ssa-loop-manip.cc:489
0x133742d find_uses_to_rename
        ../../gcc-trunk/gcc/tree-ssa-loop-manip.cc:521
0x133742d rewrite_into_loop_closed_ssa_1
        ../../gcc-trunk/gcc/tree-ssa-loop-manip.cc:588
0x133742d rewrite_into_loop_closed_ssa(bitmap_head*, unsigned int)
        ../../gcc-trunk/gcc/tree-ssa-loop-manip.cc:628
0x124c35f loop_distribution::execute(function*)
        ../../gcc-trunk/gcc/tree-loop-distribution.cc:3969
0x124c82f execute
        ../../gcc-trunk/gcc/tree-loop-distribution.cc:4016
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[518] % 
[518] % cat small.c
int a[3], b, c, d[3], e;
int main() {
  for (; e < 3; e++) {
    a[0] = 0;
    b && (c = b);
    d[e] = 0;
    a[e] = 0;
  }
  return 0;
}

[Bug tree-optimization/116380] [13/14/15 regression] ICE on valid code at -O3 with "-fno-tree-scev-cprop" on x86_64-linux-gnu: Segmentation fault

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116380

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.5
           Keywords|                            |ice-on-valid-code
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
            Summary|ICE on valid code at -O3    |[13/14/15 regression] ICE
                   |with "-fno-tree-scev-cprop" |on valid code at -O3 with
                   |on x86_64-linux-gnu:        |"-fno-tree-scev-cprop" on
                   |Segmentation fault          |x86_64-linux-gnu:
                   |                            |Segmentation fault
   Last reconfirmed|                            |2024-08-15

--- Comment #1 from Sam James <sjames at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/116380] [13/14/15 regression] ICE on valid code at -O3 with "-fno-tree-scev-cprop" on x86_64-linux-gnu: Segmentation fault

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116380

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Might be slightly easier to understand testcase:
```
int a[3], d[3], c;
int f(int e, int b) {
  for (; e < 3; e++) {
    a[0] = 0;
    if (b)
      c = b;
    d[e] = 0;
    a[e] = 0;
  }
  return e;
}
```
And `-O2 -funswitch-loops -fno-tree-scev-cprop`. I am not sure if the IR coming
out of unswitch is bad or ldist is going wrong.

[Bug tree-optimization/116380] [13/14/15 regression] ICE on valid code at -O3 with "-fno-tree-scev-cprop" on x86_64-linux-gnu: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116380

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |15.0
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
There's

<bb 6> [local count: 201326592]:
# e_25 = PHI <e_13(19), e_32(12)>
# c_lsm.3_6 = PHI <(19), c_lsm.3_26(12)>
# c_lsm_flag.4_21 = PHI <1(19), c_lsm_flag.4_27(12)>
if (c_lsm_flag.4_21 != 0)
  goto <bb 7>; [66.67%]
else
  goto <bb 8>; [33.33%]

where the PHI value is missing on the path we pattern-matched a memset.  It
was a default-def and should have been left alone.  Probably failure of the
manual SSA updating code.

I'll have a look.

[Bug tree-optimization/116380] [13/14/15 regression] ICE on valid code at -O3 with "-fno-tree-scev-cprop" on x86_64-linux-gnu: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116380

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Caused by r13-1728-gce92603fbe3b48 of course, testing fix.

[Bug tree-optimization/116380] [13/14/15 regression] ICE on valid code at -O3 with "-fno-tree-scev-cprop" on x86_64-linux-gnu: Segmentation fault

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116380

--- Comment #5 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:af0d2d95a5f767d92bd64f959679fb4612247b0b

commit r15-3069-gaf0d2d95a5f767d92bd64f959679fb4612247b0b
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Aug 21 13:56:40 2024 +0200

    tree-optimization/116380 - bogus SSA update with loop distribution

    When updating LC PHIs after copying loops we have to handle defs
    defined outside of the loop appropriately (by not setting them to
    NULL ...).  This mimics how we handle this in the SSA updating
    code of the vectorizer.

            PR tree-optimization/116380
            * tree-loop-distribution.cc (copy_loop_before): Handle
            out-of-loop defs appropriately.

            * gcc.dg/torture/pr116380.c: New testcase.

[Bug tree-optimization/116380] [13/14 regression] ICE on valid code at -O3 with "-fno-tree-scev-cprop" on x86_64-linux-gnu: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116380

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13/14/15 regression] ICE   |[13/14 regression] ICE on
                   |on valid code at -O3 with   |valid code at -O3 with
                   |"-fno-tree-scev-cprop" on   |"-fno-tree-scev-cprop" on
                   |x86_64-linux-gnu:           |x86_64-linux-gnu:
                   |Segmentation fault          |Segmentation fault
      Known to work|                            |15.0

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug tree-optimization/116380] [13/14 regression] ICE on valid code at -O3 with "-fno-tree-scev-cprop" on x86_64-linux-gnu: Segmentation fault

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116380

--- Comment #7 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-14 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:8f8a7e1f1904e389e736c0265b4f515f3ce13659

commit r14-10682-g8f8a7e1f1904e389e736c0265b4f515f3ce13659
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Aug 21 13:56:40 2024 +0200

    tree-optimization/116380 - bogus SSA update with loop distribution

    When updating LC PHIs after copying loops we have to handle defs
    defined outside of the loop appropriately (by not setting them to
    NULL ...).  This mimics how we handle this in the SSA updating
    code of the vectorizer.

            PR tree-optimization/116380
            * tree-loop-distribution.cc (copy_loop_before): Handle
            out-of-loop defs appropriately.

            * gcc.dg/torture/pr116380.c: New testcase.

    (cherry picked from commit af0d2d95a5f767d92bd64f959679fb4612247b0b)