[Bug ipa/94217] New: [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[Bug ipa/94217] New: [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

            Bug ID: 94217
           Summary: [10 Regression] ICE in ipa_find_agg_cst_for_param, at
                    ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: jakub at gcc dot gnu.org, marxin at gcc dot gnu.org,
                    rguenth at gcc dot gnu.org
  Target Milestone: ---

Related to the same revision as PR94216, but it's not fixed with
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94216#c1:

$ cat star.ii
template <typename _T2> struct A { A(int, _T2); };
template <typename, typename, typename, typename, typename = int> class B {
  struct C {
    C(B &p1) : _M_t(p1) {}
    template <typename _Arg> void operator()(_Arg) { _M_t._M_create_node(); }
    B &_M_t;
  };
  void _M_create_node();
  int _S_key() {  }
  template <typename _Arg, typename _NodeGen>
  int _M_insert_(int *, int *, _Arg &&, _NodeGen &);

public:
  template <typename _Arg> A<bool> _M_insert_unique(_Arg &&);
};
template <typename _Key, typename _Val, typename _KeyOfValue, typename
_Compare,
          typename _Alloc>
template <typename _Arg, typename _NodeGen>
int B<_Key, _Val, _KeyOfValue, _Compare, _Alloc>::_M_insert_(int *p1, int *p2,
                                                             _Arg &&,
                                                             _NodeGen &p4) {
  p1 || p2 || _S_key();
  p4(0);
}
template <typename _Key, typename _Val, typename _KeyOfValue, typename
_Compare,
          typename _Alloc>
template <typename _Arg>
A<bool>
B<_Key, _Val, _KeyOfValue, _Compare, _Alloc>::_M_insert_unique(_Arg &&) {
  int a;
  int *b;
  C c(*this);
  _M_insert_(&a, b, 0, c);
  return A<bool> (1, false);
}
struct IdIsoLanguageEntry;
class D {
public:
  typedef A<IdIsoLanguageEntry> value_type;
  B<int, int, int, int> _M_t;
  void insert(value_type p1) { _M_t._M_insert_unique(p1); }
};
class F {
public:
  F(const char *);
};
enum { LANGUAGE_ENGLISH };
struct IdIsoLanguageEntry {
  int m_languageId;
  const char m_language[3];
  F m_country;
} d[]{LANGUAGE_ENGLISH, "", ""};
class IdIsoLanguageMap {
public:
  IdIsoLanguageMap() {
    for (auto l : d)
      m_idLanguageMap.insert(D::value_type(l.m_languageId, l));
  }
  D m_idLanguageMap;
} e;

$ g++ star.ii -c -flto -O2 -o x.o && gcc -shared x.o
star.ii: In member function ‘int B< <template-parameter-1-1>,
<template-parameter-1-2>, <template-parameter-1-3>, <template-parameter-1-4>,
<template-parameter-1-5> >::_S_key()’:
star.ii:9:19: warning: no return statement in function returning non-void
[-Wreturn-type]
    9 |   int _S_key() {  }
      |                   ^
star.ii: In member function ‘int B< <template-parameter-1-1>,
<template-parameter-1-2>, <template-parameter-1-3>, <template-parameter-1-4>,
<template-parameter-1-5> >::_M_insert_(int*, int*, _Arg&&, _NodeGen&)’:
star.ii:24:1: warning: no return statement in function returning non-void
[-Wreturn-type]
   24 | }
      | ^
during IPA pass: cp
lto1: internal compiler error: in ipa_find_agg_cst_for_param, at
ipa-prop.c:3467
0xdc77e7 ipa_find_agg_cst_for_param(ipa_agg_value_set*, tree_node*, long, bool,
bool*)
        /home/marxin/Programming/gcc/gcc/ipa-prop.c:3467
0xd87e7f evaluate_conditions_for_known_args
        /home/marxin/Programming/gcc/gcc/ipa-fnsummary.c:371
0xd93a6a estimate_ipcp_clone_size_and_time(cgraph_node*, vec<tree_node*,
va_heap, vl_ptr>, vec<ipa_polymorphic_call_context, va_heap, vl_ptr>,
vec<ipa_agg_value_set, va_heap, vl_ptr>, int*, sreal*, sreal*, int*)
        /home/marxin/Programming/gcc/gcc/ipa-fnsummary.c:3658
0x205c840 estimate_local_effects
        /home/marxin/Programming/gcc/gcc/ipa-cp.c:3478
0x205d78a propagate_constants_topo
        /home/marxin/Programming/gcc/gcc/ipa-cp.c:3816
0x205da33 ipcp_propagate_stage
        /home/marxin/Programming/gcc/gcc/ipa-cp.c:3912
0x206262e ipcp_driver
        /home/marxin/Programming/gcc/gcc/ipa-cp.c:5908
0x2062814 execute
        /home/marxin/Programming/gcc/gcc/ipa-cp.c:6001
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
lto-wrapper: fatal error: gcc returned 1 exit status
compilation terminated.
/usr/bin/ld: error: lto-wrapper failed
collect2: error: ld returned 1 exit status

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
     Ever confirmed|0                           |1
      Known to fail|                            |10.0
   Last reconfirmed|                            |2020-03-18
   Target Milestone|---                         |10.0
             Status|UNCONFIRMED                 |NEW
           Priority|P3                          |P1
      Known to work|                            |9.3.0

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[xerofoify at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

Nicholas Krause <xerofoify at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |xerofoify at gmail dot com

--- Comment #1 from Nicholas Krause <xerofoify at gmail dot com> ---
Hi Marin,
I've not sure if this is correct but it does not ICE with this fix:
                tree off = fold_convert (ptr_type_node, op1);
-                   return build_fold_addr_expr_loc
-                       (loc,
+                   return build1_loc
+                       (loc, ADDR_EXPR, TREE_TYPE (op0),
                         fold_build2 (MEM_REF,
                                      TREE_TYPE (TREE_TYPE (op0)),
                                      unshare_expr (op0), off));

should actually be:  
(EXPR_LOCATION(off), ADDR_EXPR, TREE_TYPE (op0),
                         fold_build2 (MEM_REF,
                                      TREE_TYPE (TREE_TYPE (op0)),
                                      unshare_expr (op0), off));

I've tested with your file and I get:
star.ii: In member function ‘int B< <template-parameter-1-1>,
<template-parameter-1-2>, <template-parameter-1-3>, <template-parameter-1-4>,
<template-parameter-1-5> >::_S_key()’:
star.ii:9:19: warning: no return statement in function returning non-void
[-Wreturn-type]
    9 |   int _S_key() {  }
      |                   ^
star.ii: In member function ‘int B< <template-parameter-1-1>,
<template-parameter-1-2>, <template-parameter-1-3>, <template-parameter-1-4>,
<template-parameter-1-5> >::_M_insert_(int*, int*, _Arg&&, _NodeGen&)’:
star.ii:24:1: warning: no return statement in function returning non-void
[-Wreturn-type]
   24 | }


However this seems to be on multiple ade package files so can you test it
against that as well.

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mpolacek at gcc dot gnu.org

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
(In reply to Nicholas Krause from comment #1)
> Hi Marin,
> I've not sure if this is correct but it does not ICE with this fix:
>                 tree off = fold_convert (ptr_type_node, op1);
> -                   return build_fold_addr_expr_loc
> -                       (loc,
> +                   return build1_loc
> +                       (loc, ADDR_EXPR, TREE_TYPE (op0),
>                          fold_build2 (MEM_REF,
>                                       TREE_TYPE (TREE_TYPE (op0)),
>                                       unshare_expr (op0), off));
> 
> should actually be:  
> (EXPR_LOCATION(off), ADDR_EXPR, TREE_TYPE (op0),
>                          fold_build2 (MEM_REF,
>                                       TREE_TYPE (TREE_TYPE (op0)),
>                                       unshare_expr (op0), off));

Huh?  Why do you think that changing the location should fix the ICE?  That's a
completely random change that you never bothered to test, because it doesn't
fix the crash.

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[xerofoify at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

--- Comment #3 from Nicholas Krause <xerofoify at gmail dot com> ---
(In reply to Marek Polacek from comment #2)
> (In reply to Nicholas Krause from comment #1)
> > Hi Marin,
> > I've not sure if this is correct but it does not ICE with this fix:
> >                 tree off = fold_convert (ptr_type_node, op1);
> > -                   return build_fold_addr_expr_loc
> > -                       (loc,
> > +                   return build1_loc
> > +                       (loc, ADDR_EXPR, TREE_TYPE (op0),
> >                          fold_build2 (MEM_REF,
> >                                       TREE_TYPE (TREE_TYPE (op0)),
> >                                       unshare_expr (op0), off));
> > 
> > should actually be:  
> > (EXPR_LOCATION(off), ADDR_EXPR, TREE_TYPE (op0),
> >                          fold_build2 (MEM_REF,
> >                                       TREE_TYPE (TREE_TYPE (op0)),
> >                                       unshare_expr (op0), off));
> 
> Huh?  Why do you think that changing the location should fix the ICE? 
> That's a completely random change that you never bothered to test, because
> it doesn't fix the crash.

Here is my exact output of testing the change:
[xerofoify@gcc2-power8 bin]$ ./g++ star.ii -c -flto -O2 -o x.o && ./gcc -shared
x.o
star.ii: In member function ‘int B< <template-parameter-1-1>,
<template-parameter-1-2>, <template-parameter-1-3>, <template-parameter-1-4>,
<template-parameter-1-5> >::_S_key()’:
star.ii:9:19: warning: no return statement in function returning non-void
[-Wreturn-type]
    9 |   int _S_key() {  }
      |                   ^
star.ii: In member function ‘int B< <template-parameter-1-1>,
<template-parameter-1-2>, <template-parameter-1-3>, <template-parameter-1-4>,
<template-parameter-1-5> >::_M_insert_(int*, int*, _Arg&&, _NodeGen&)’:
star.ii:24:1: warning: no return statement in function returning non-void
[-Wreturn-type]
   24 | }
      | ^

If you look at the revision mentioned for this bug in gimple-fold.c here:
                    tree off = fold_convert (ptr_type_node, op1);
-                   return build_fold_addr_expr_loc
-                       (loc,
+                   return build1_loc
+                       (loc, ADDR_EXPR, TREE_TYPE (op0),
that's incorrect as loc is not the tree we want but off and from that the
EXPR_LOCATION of that tree. Does that make more sense now?

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Nicholas Krause from comment #1)
> Hi Marin,

s/Marin/Martin

@Nicholas: As Marek said, please do not propose changes that are not completely
tested and that are more just quests. An issue like this is super covered: we
know starting revision and the changes were made by our very senior developers
(Richard and Jakub). That means they will fix the issue quickly and with
consideration of all possible pitfalls.

If you are interested in solving bugzilla issue, please take a look at issues
that haven't had attention for a long time.

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 48060
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48060&action=edit
Reduced test-case without a warning

$ gcc -O2 -flto star.ii -shared
during IPA pass: cp
lto1: internal compiler error: in ipa_find_agg_cst_for_param, at
ipa-prop.c:3467
0x66038d ipa_find_agg_cst_for_param(ipa_agg_value_set*, tree_node*, long, bool,
bool*)
        /home/marxin/Programming/gcc/gcc/ipa-prop.c:3467
0x66038d ipa_find_agg_cst_for_param(ipa_agg_value_set*, tree_node*, long, bool,
bool*)
        /home/marxin/Programming/gcc/gcc/ipa-prop.c:3440
0xae630f evaluate_conditions_for_known_args
        /home/marxin/Programming/gcc/gcc/ipa-fnsummary.c:371
0xaefdb9 estimate_ipcp_clone_size_and_time(cgraph_node*, vec<tree_node*,
va_heap, vl_ptr>, vec<ipa_polymorphic_call_context, va_heap, vl_ptr>,
vec<ipa_agg_value_set, va_heap, vl_ptr>, int*, sreal*, sreal*, int*)
        /home/marxin/Programming/gcc/gcc/ipa-fnsummary.c:3658
0x167ff18 estimate_local_effects
        /home/marxin/Programming/gcc/gcc/ipa-cp.c:3478
0x168a26f propagate_constants_topo
        /home/marxin/Programming/gcc/gcc/ipa-cp.c:3816
0x168a26f ipcp_propagate_stage
        /home/marxin/Programming/gcc/gcc/ipa-cp.c:3912
0x168a26f ipcp_driver
        /home/marxin/Programming/gcc/gcc/ipa-cp.c:5908
0x168a26f execute
        /home/marxin/Programming/gcc/gcc/ipa-cp.c:6001
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
lto-wrapper: fatal error: gcc returned 1 exit status
compilation terminated.
/usr/bin/ld: error: lto-wrapper failed
collect2: error: ld returned 1 exit status

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Testing patch.

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:f3280e4c0c98e103603bafc466ea49651fe0b7f2

commit r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Mar 19 10:19:24 2020 +0100

    ipa/94217 simplify offsetted address build

    This avoids using build_ref_for_offset and build_fold_addr_expr
    where type mixup easily results in something not IP invariant.

    2020-03-19  Richard Biener  <rguenther@suse.de>

            PR ipa/94217
            * ipa-cp.c (ipa_get_jf_ancestor_result): Avoid build_fold_addr_expr
            and build_ref_for_offset.

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

Tamar Christina <tnfchris at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tnfchris at gcc dot gnu.org

--- Comment #10 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
The commit f3280e4c0c98 seems to be causing various miscompares in SPEC2017, I
haven't tried to narrow it down yet but it's causing omnetpp and xalancbmk to
fail.

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

--- Comment #11 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
At least on aarch64, I haven't tried x86_64 yet.

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

Tamar Christina <tnfchris at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|FIXED                       |---
             Status|RESOLVED                    |REOPENED

--- Comment #12 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
Also confirmed on x86_64.

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

--- Comment #13 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Tamar Christina from comment #12)
> Also confirmed on x86_64.

Can you confirm it's not fixed with g:7d4549b2cd209eb621453ce13be7ffd84ffa720a?

[Bug ipa/94217] [10 Regression] ICE in ipa_find_agg_cst_for_param, at ipa-prop.c:3467 since r10-7237-g4e3d3e40726e1b68

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94217

Tamar Christina <tnfchris at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #14 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
(In reply to Martin Liška from comment #13)
> (In reply to Tamar Christina from comment #12)
> > Also confirmed on x86_64.
> 
> Can you confirm it's not fixed with
> g:7d4549b2cd209eb621453ce13be7ffd84ffa720a?

Ah it is indeed fixed.. I hadn't seen another commit here and missed it in the
log thanks to some huge changelogs...

Sorry for the noise!