[Bug c/94726] New: internal compiler error: in uniform_vector_p, at tree.c:11214

[Bug c/94726] New: internal compiler error: in uniform_vector_p, at tree.c:11214

[anbu1024.me at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

            Bug ID: 94726
           Summary: internal compiler error: in uniform_vector_p, at
                    tree.c:11214
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: anbu1024.me at gmail dot com
  Target Milestone: ---

$ cat reduced.c 

typedef unsigned int type __attribute__ ( ( vector_size ( 8 ) ) ) ; 

type a , b; 

void foo ( void ) { 
        type var = { 2 , 2 } ; 
        b = __builtin_shuffle ( a , var ) ;
} 


void * a [ ] = { } ; 

--------------------------------------------------------------------------------

$ gcc-10 --version
gcc (GCC) 10.0.1 20200419 (experimental)
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

--------------------------------------------------------------------------------

$ gcc-10 reduced.c 
reduced.c:12:8: error: conflicting types for ‘a’
   12 | void * a [ ] = { } ;
      |        ^
reduced.c:4:6: note: previous declaration of ‘a’ was here
    4 | type a , b;
      |      ^
reduced.c: In function ‘foo’:
reduced.c:8:6: internal compiler error: in uniform_vector_p, at tree.c:11214
    8 |  b = __builtin_shuffle ( a , var ) ;
      |      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x736228 uniform_vector_p(tree_node const*)
        ../../gcc-10-20200419/gcc/tree.c:11214
0x1184786 gimple_vec_same_elem_p(tree_node*, tree_node* (*)(tree_node*))
        /home/john/Documents/fuzz/gcc/10-20200419/build/gcc/gimple-match.c:1002
0x12ab6ca gimple_simplify_VEC_PERM_EXPR
       
/home/john/Documents/fuzz/gcc/10-20200419/build/gcc/gimple-match.c:122872
0x1188bca gimple_resimplify3
        ../../gcc-10-20200419/gcc/gimple-match-head.c:394
0x11d49aa gimple_simplify(gimple*, gimple_match_op*, gimple**, tree_node*
(*)(tree_node*), tree_node* (*)(tree_node*))
        ../../gcc-10-20200419/gcc/gimple-match-head.c:1059
0xad0b2f fold_stmt_1
        ../../gcc-10-20200419/gcc/gimple-fold.c:5087
0xb14771 gimplify_modify_expr
        ../../gcc-10-20200419/gcc/gimplify.c:5942
0xafd53c gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        ../../gcc-10-20200419/gcc/gimplify.c:13608
0xb00bd6 gimplify_stmt(tree_node**, gimple**)
        ../../gcc-10-20200419/gcc/gimplify.c:6825
0xb03327 gimplify_and_add(tree_node*, gimple**)
        ../../gcc-10-20200419/gcc/gimplify.c:486
0xb03327 internal_get_tmp_var
        ../../gcc-10-20200419/gcc/gimplify.c:642
0xafc8ff get_formal_tmp_var(tree_node*, gimple**)
        ../../gcc-10-20200419/gcc/gimplify.c:663
0xafc8ff gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        ../../gcc-10-20200419/gcc/gimplify.c:14609
0xb14595 gimplify_modify_expr
        ../../gcc-10-20200419/gcc/gimplify.c:5792
0xafd53c gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        ../../gcc-10-20200419/gcc/gimplify.c:13608
0xb00bd6 gimplify_stmt(tree_node**, gimple**)
        ../../gcc-10-20200419/gcc/gimplify.c:6825
0xafe48b gimplify_statement_list
        ../../gcc-10-20200419/gcc/gimplify.c:1869
0xafe48b gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        ../../gcc-10-20200419/gcc/gimplify.c:14052
0xb00bd6 gimplify_stmt(tree_node**, gimple**)
        ../../gcc-10-20200419/gcc/gimplify.c:6825
0xb0199b gimplify_bind_expr
        ../../gcc-10-20200419/gcc/gimplify.c:1424
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

--------------------------------------------------------------------------------

$ gcc-9 --version
gcc (GCC) 9.2.1 20191102
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

--------------------------------------------------------------------------------

$ gcc-9 reduced.c 
reduced.c:12:8: error: conflicting types for ‘a’
   12 | void * a [ ] = { } ;
      |        ^
reduced.c:4:6: note: previous declaration of ‘a’ was here
    4 | type a , b;
      |      ^

[Bug middle-end/94726] [10 Regression] internal compiler error: in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-04-23
      Known to fail|                            |10.0
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |prathamesh3492 at gcc dot gnu.org
            Summary|[10 Regression] internal    |[10 Regression] internal
                   |compiler error: in          |compiler error: in
                   |uniform_vector_p, at        |uniform_vector_p, at
                   |tree.c:11214                |tree.c:11214 since
                   |                            |r10-2089-g21caa1a2649d586f
     Ever confirmed|0                           |1
   Target Milestone|---                         |10.0
             Status|UNCONFIRMED                 |ASSIGNED
      Known to work|                            |9.3.0

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed, started with r10-2089-g21caa1a2649d586f.
Let me take a look.

[Bug c/94726] [10 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jsm28 at gcc dot gnu.org,
                   |                            |mpolacek at gcc dot gnu.org
          Component|middle-end                  |c

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
So we are building the VEC_PERM_EXPR at a point where 'a' has vector type but
then later via

(gdb) bt
#0  pop_scope () at ../../src/trunk/gcc/c/c-decl.c:1375
#1  0x0000000000976572 in pop_file_scope ()
    at ../../src/trunk/gcc/c/c-decl.c:1456
#2  0x0000000000ac6667 in c_common_parse_file ()
    at ../../src/trunk/gcc/c-family/c-opts.c:1191
#3  0x000000000132b2e0 in compile_file () at ../../src/trunk/gcc/toplev.c:458
#4  0x000000000132e469 in do_compile () at ../../src/trunk/gcc/toplev.c:2273

we are patching up its type to an ARRAY_TYPE, resulting in invalid GENERIC
for the formerly built tree.

We should do no such thing here.  Iff the FE wants to continue then it
should simply remove the shadowed decl from the bindings and continue
with the shadowing one.  But here it seems to patch something up
what wasn't "merged" during duplicate_decls so clearly something is "off".

Oddly enough both b and b->shadowed refer to the same decl(?) and with
vector type(!).  I guess I don't really understand the purpose of
the type "restore(?)" below:

tree
pop_scope (void)
{
...
          /* It is possible for a decl not to have a name.  We get
             here with b->id NULL in this case.  */
          if (b->id)
            {
              gcc_assert (I_SYMBOL_BINDING (b->id) == b);
              I_SYMBOL_BINDING (b->id) = b->shadowed;
              if (b->shadowed && b->shadowed->u.type)
                TREE_TYPE (b->shadowed->decl) = b->shadowed->u.type;


Martin, while we certainly can paper over this in the middle-end the
issue clearly lies in the FE so I suggest to leave this to FE maintainers
to sort out.

I suppose similar issues might arise with

double a;
double foo () { return a / 3.0; };

int a = 0;

where we should get a RDIV_EXPR with integer typed a. Hum, no, for some
unknown reason _this_ testcase has 'a' still have double type and we
do not run into the above code?!  Ah, so in _this_ case we have
two different decls in b->decl vs. b->shadowed->decl and
b->shadowed->u.type is NULL.

Err, for the vector case we get everything correct up to popping
the vector a which somehow has itself registered as shadowed
but with array type?!

OK, so for the vector case we register two bindings for the same decl:

#0  0x000000000097496f in bind (name=<identifier_node 0x7ffff6d7d960 a>, 
    decl=<var_decl 0x7ffff7fedb40 a>, scope=0x7ffff6c3b300, invisible=true, 
    nested=false, locus=266848) at ../../src/trunk/gcc/c/c-decl.c:729
#1  0x000000000097e409 in pushdecl (x=<var_decl 0x7ffff7fedb40 a>)
    at ../../src/trunk/gcc/c/c-decl.c:3274
#2  0x0000000000982c4f in start_decl (declarator=0x3764510, 
    declspecs=0x3764450, initialized=false, attributes=<tree 0x0>)
    at ../../src/trunk/gcc/c/c-decl.c:5177

and then

#0  0x000000000097496f in bind (name=<identifier_node 0x7ffff6d7d960 a>, 
    decl=<var_decl 0x7ffff7fedb40 a>, scope=0x7ffff6d7e1e0, invisible=false, 
    nested=true, locus=266848) at ../../src/trunk/gcc/c/c-decl.c:729
#1  0x000000000097e485 in pushdecl (x=<var_decl 0x7ffff7fedb40 a>)
    at ../../src/trunk/gcc/c/c-decl.c:3295
#2  0x0000000000982c4f in start_decl (declarator=0x3764510, 
    declspecs=0x3764450, initialized=false, attributes=<tree 0x0>)
    at ../../src/trunk/gcc/c/c-decl.c:5177

and then update u.type of the shadowed here:

  /* Deduce size of array from initialization, if not already known.
     This is only needed for an initialization in the current scope;
     it must not be done for a file-scope initialization of a
     declaration with external linkage, redeclared in an inner scope
     with the outer declaration shadowed in an intermediate scope.  */
  if (TREE_CODE (type) == ARRAY_TYPE
      && TYPE_DOMAIN (type) == NULL_TREE
      && TREE_CODE (decl) != TYPE_DECL
      && !(TREE_PUBLIC (decl) && current_scope != file_scope))
    {
...
        case 0:
          /* For global variables, update the copy of the type that
             exists in the binding.  */
          if (TREE_PUBLIC (decl))
            {
              struct c_binding *b_ext = I_SYMBOL_BINDING (DECL_NAME (decl));
              while (b_ext && !B_IN_EXTERNAL_SCOPE (b_ext))
                b_ext = b_ext->shadowed;
              if (b_ext && TREE_CODE (decl) == TREE_CODE (b_ext->decl))
                {
                  if (b_ext->u.type && comptypes (b_ext->u.type, type))
                    b_ext->u.type = composite_type (b_ext->u.type, type);
                  else
                    b_ext->u.type = type;

so the special case here is an array initializer.  Indeed the following
testcase exposes the bogus RDIV_EXPR:

double a;
double foo () { return a / 3.0; };

int a[] = { 0 };

but we're not consuming the bogus IL anywhere it would ICE.

[Bug c/94726] [10 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|marxin at gcc dot gnu.org          |unassigned at gcc dot gnu.org
             Status|ASSIGNED                    |NEW

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Leaving to a C maintainer.

[Bug c/94726] [10 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
           Priority|P3                          |P4

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Bet dup of PR94730 and PR94731, it is really the same problem, the middle-end
is unhappy if types of variables used in functions change to random different
type later.

[Bug c/94726] [10/11 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.0                        |10.2

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.1 has been released.

[Bug c/94726] [10/11 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.2                        |10.3

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10.2 is released, adjusting target milestone.

[Bug c/94726] [10/11 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.3                        |10.4

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10.3 is being released, retargeting bugs to GCC 10.4.

[Bug c/94726] [10/11/12 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

--- Comment #8 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
After r12-3278-g823685221de986a, the ICE moved slightly:


t.c:13:8: error: conflicting types for ‘a’; have ‘void *[]’
   13 | void * a [ ] = { } ;
      |        ^
t.c:5:6: note: previous declaration of ‘a’ with type ‘type’ {aka ‘__vector(2)
unsigned int’}
    5 | type a , b;
      |      ^
t.c: In function ‘foo’:
t.c:9:13: internal compiler error: tree check: expected class ‘type’, have
‘exceptional’ (error_mark) in create_tmp_from_val, at gimplify.c:568
    9 |         b = __builtin_shuffle ( a , var ) ;
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x6a9973 tree_class_check_failed(tree_node const*, tree_code_class, char
const*, int, char const*)
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/tree.c:8739
0xa9548f tree_class_check(tree_node*, tree_code_class, char const*, int, char
const*)
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/tree.h:3546
0xa9548f create_tmp_from_val
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/gimplify.c:568
0xa9548f lookup_tmp_var
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/gimplify.c:601
0xa9548f internal_get_tmp_var
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/gimplify.c:640
0xa98b83 get_initialized_tmp_var(tree_node*, gimple**, gimple**, bool)
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/gimplify.c:679
0xa98b83 gimplify_save_expr
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/gimplify.c:6251
0xa8f2ff gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/gimplify.c:14857
0xa8e39b gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/gimplify.c:15335

[Bug c/94726] [10/11/12 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |pinskia at gcc dot gnu.org

--- Comment #9 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I have a simple fix.
diff --git a/gcc/gimplify.c b/gcc/gimplify.c
index 9163dcda438..943c5cb8f2d 100644
--- a/gcc/gimplify.c
+++ b/gcc/gimplify.c
@@ -6232,6 +6232,9 @@ gimplify_save_expr (tree *expr_p, gimple_seq *pre_p,
gimple_seq *post_p)
   gcc_assert (TREE_CODE (*expr_p) == SAVE_EXPR);
   val = TREE_OPERAND (*expr_p, 0);

+  if (TREE_TYPE (val) == error_mark_node)
+    return GS_ERROR;
+
   /* If the SAVE_EXPR has not been resolved, then evaluate it once.  */
   if (!SAVE_EXPR_RESOLVED_P (*expr_p))
     {

[Bug c/94726] [10/11/12 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://gcc.gnu.org/piperma
                   |                            |il/gcc-patches/2021-Septemb
                   |                            |er/580264.html
           Keywords|                            |patch

--- Comment #10 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Patch submitted:
https://gcc.gnu.org/pipermail/gcc-patches/2021-September/580264.html

[Bug c/94726] [10/11/12 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Andrew Pinski <pinskia@gcc.gnu.org>:

https://gcc.gnu.org/g:76773d3fea4daaaf5b0f6d79d9f48ffe6b3c97fd

commit r12-3896-g76773d3fea4daaaf5b0f6d79d9f48ffe6b3c97fd
Author: Andrew Pinski <apinski@marvell.com>
Date:   Sun Sep 26 05:44:58 2021 +0000

    Fix PR c/94726: ICE with __builtin_shuffle and changing of types

    The problem here is __builtin_shuffle when called with two arguments
    instead of 1, uses a SAVE_EXPR to put in for the 1st and 2nd operand
    of VEC_PERM_EXPR and when we go and gimplify the SAVE_EXPR, the type
    is now error_mark_node and that fails hard.
    This fixes the problem by adding a simple check for type of operand
    of SAVE_EXPR not to be error_mark_node.

    OK? Bootstrapped and tested on aarch64-linux-gnu with no regressions.

    gcc/ChangeLog:

            PR c/94726
            * gimplify.c (gimplify_save_expr): Return early
            if the type of val is error_mark_node.

    gcc/testsuite/ChangeLog:

            PR c/94726
            * gcc.dg/pr94726.c: New test.

[Bug c/94726] [10/11/12 Regression] ICE in uniform_vector_p, at tree.c:11214 since r10-2089-g21caa1a2649d586f

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94726

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|10.4                        |12.0

--- Comment #12 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Fixed on the trunk.  Not backporting as this is an ICE after error case only.