[Bug target/94980] New: [10/11 Regression] ICE: verify_gimple failed: position plus size exceeds size of referenced object in 'bit_field_ref' with -mavx512vl

[Bug target/94980] New: [10/11 Regression] ICE: verify_gimple failed: position plus size exceeds size of referenced object in 'bit_field_ref' with -mavx512vl

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94980

            Bug ID: 94980
           Summary: [10/11 Regression] ICE: verify_gimple failed: position
                    plus size exceeds size of referenced object in
                    'bit_field_ref' with -mavx512vl
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu

Created attachment 48473
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48473&action=edit
reduced testcase

Maybe related to PR94438

Compiler output:
$ x86_64-pc-linux-gnu-gcc -mavx512vl testcase.c 
testcase.c: In function 'foo':
testcase.c:4:1: error: position plus size exceeds size of referenced object in
'bit_field_ref'
    4 | foo(void)
      | ^~~
_11 = BIT_FIELD_REF <_10, 8, 8>;
testcase.c:4:1: error: position plus size exceeds size of referenced object in
'bit_field_ref'
_14 = BIT_FIELD_REF <_13, 8, 8>;
testcase.c:4:1: error: position plus size exceeds size of referenced object in
'bit_field_ref'
_19 = BIT_FIELD_REF <_18, 8, 16>;
testcase.c:4:1: error: position plus size exceeds size of referenced object in
'bit_field_ref'
_22 = BIT_FIELD_REF <_21, 8, 16>;
testcase.c:4:1: error: position plus size exceeds size of referenced object in
'bit_field_ref'
_27 = BIT_FIELD_REF <_26, 8, 24>;
testcase.c:4:1: error: position plus size exceeds size of referenced object in
'bit_field_ref'
_30 = BIT_FIELD_REF <_29, 8, 24>;
during GIMPLE pass: veclower
testcase.c:4:1: internal compiler error: verify_gimple failed
0x10ec191 verify_gimple_in_cfg(function*, bool)
        /repo/gcc-trunk/gcc/tree-cfg.c:5470
0xfa0c6f execute_function_todo
        /repo/gcc-trunk/gcc/passes.c:1985
0xfa1a4e execute_todo
        /repo/gcc-trunk/gcc/passes.c:2039
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r11-158-20200507093816-gb24fc8a692e-checking-yes-rtl-extra-nobootstrap-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/11.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,extra
--disable-bootstrap --with-cloog --with-ppl --with-isl
--build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu
--target=x86_64-pc-linux-gnu --with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r11-158-20200507093816-gb24fc8a692e-checking-yes-rtl-extra-nobootstrap-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.0.0 20200507 (experimental) (GCC)

[Bug target/94980] [8/9/10/11 Regression] ICE: verify_gimple failed: position plus size exceeds size of referenced object in 'bit_field_ref' with -mavx512vl

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94980

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-05-07
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |rsandifo at gcc dot gnu.org
            Summary|[10/11 Regression] ICE:     |[8/9/10/11 Regression] ICE:
                   |verify_gimple failed:       |verify_gimple failed:
                   |position plus size exceeds  |position plus size exceeds
                   |size of referenced object   |size of referenced object
                   |in 'bit_field_ref' with     |in 'bit_field_ref' with
                   |-mavx512vl                  |-mavx512vl
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed, started with r8-5447-g36fd64086542ed73.

[Bug target/94980] [8/9/10/11 Regression] ICE: verify_gimple failed: position plus size exceeds size of referenced object in 'bit_field_ref' with -mavx512vl

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94980

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rsandifo at gcc dot gnu.org

--- Comment #2 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Mine.  Looks like the problem was latent before.  The testcase
ends up using vector boolean types with 2-bit element types.
Before that patch we computed the TYPE_SIZE of the vector type as:

        TYPE_SIZE (type) = int_const_binop (MULT_EXPR,
                                            TYPE_SIZE (innertype),
                                            bitsize_int (nunits));

where the TYPE_SIZE of the boolean is 8 bits.  So the TYPE_SIZE
of the vector was 4*8 == 32 bits, even though the TYPE_SIZE_UNIT
was only 1 byte.  This meant that the BIT_FIELD_REFs passed the
tree-cfg.c checks but led to incorrect rtl:

;; _13 = { -1, -1, -1, -1 };

(insn 18 17 0 (set (reg:QI 92 [ _13 ])
        (const_int 15 [0xf])) "/tmp/pr94980.c":6:17 -1
     (nil))

;; _14 = BIT_FIELD_REF <_13, 8, 8>;

(insn 19 18 20 (set (mem/c:QI (plus:DI (reg/f:DI 77 virtual-stack-vars)
                (const_int -4 [0xfffffffffffffffc])) [2  S1 A8])
        (reg:QI 92 [ _13 ])) "/tmp/pr94980.c":6:17 -1
     (nil))

(insn 20 19 0 (set (reg:QI 93 [ _14 ])
        (mem/c:QI (plus:DI (reg/f:DI 77 virtual-stack-vars)
                (const_int -3 [0xfffffffffffffffd])) [0  S1 A8]))
"/tmp/pr94980.c":6:17 -1
     (nil))

where the last insn reads back uninitialised memory.

[Bug target/94980] [8/9/10/11 Regression] ICE: verify_gimple failed: position plus size exceeds size of referenced object in 'bit_field_ref' with -mavx512vl

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94980

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
           Priority|P3                          |P2
   Target Milestone|---                         |8.5

[Bug target/94980] [8/9/10/11 Regression] ICE: verify_gimple failed: position plus size exceeds size of referenced object in 'bit_field_ref' with -mavx512vl

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94980

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Sandiford <rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:d17a896da1e898928d337596d029f0ece0039d55

commit r11-311-gd17a896da1e898928d337596d029f0ece0039d55
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Tue May 12 09:01:10 2020 +0100

    tree: Add vector_element_bits(_tree) [PR94980 1/3]

    A lot of code that wants to know the number of bits in a vector
    element gets that information from the element's TYPE_SIZE,
    which is always equal to TYPE_SIZE_UNIT * BITS_PER_UNIT.
    This doesn't work for SVE and AVX512-style packed boolean vectors,
    where several elements can occupy a single byte.

    This patch introduces a new pair of helpers for getting the true
    (possibly sub-byte) size.  I made a token attempt to convert obvious
    element size calculations, but I'm sure I missed some.

    2020-05-12  Richard Sandiford  <richard.sandiford@arm.com>

    gcc/
            PR tree-optimization/94980
            * tree.h (vector_element_bits, vector_element_bits_tree): Declare.
            * tree.c (vector_element_bits, vector_element_bits_tree): New.
            * match.pd: Use the new functions instead of determining the
            vector element size directly from TYPE_SIZE(_UNIT).
            * tree-vect-data-refs.c (vect_gather_scatter_fn_p): Likewise.
            * tree-vect-patterns.c (vect_recog_mask_conversion_pattern):
Likewise.
            * tree-vect-stmts.c (vect_is_simple_cond): Likewise.
            * tree-vect-generic.c (expand_vector_piecewise): Likewise.
            (expand_vector_conversion): Likewise.
            (expand_vector_addition): Likewise for a TYPE_SIZE_UNIT used as
            a divisor.  Convert the dividend to bits to compensate.
            * tree-vect-loop.c (vectorizable_live_operation): Call
            vector_element_bits instead of open-coding it.

[Bug target/94980] [8/9/10/11 Regression] ICE: verify_gimple failed: position plus size exceeds size of referenced object in 'bit_field_ref' with -mavx512vl

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94980

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Sandiford <rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:14605b6bd8c37fffd8065c5c3fe6b1b9d7b2a294

commit r11-312-g14605b6bd8c37fffd8065c5c3fe6b1b9d7b2a294
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Tue May 12 09:01:12 2020 +0100

    tree-vect-generic: Tweak build_replicated_const [PR94980 2/3]

    This patch makes build_replicated_const take the number of bits
    in VALUE rather than calculating the width from the element type.
    The callers can then use vector_element_bits to calculate the
    correct element size from the vector type.

    2020-05-12  Richard Sandiford  <richard.sandiford@arm.com>

    gcc/
            PR tree-optimization/94980
            * tree-vect-generic.c (build_replicated_const): Take the number
            of bits as a parameter, instead of the type of the elements.
            (do_plus_minus): Update accordingly, using vector_element_bits
            to calculate the correct number of bits.
            (do_negate): Likewise.

[Bug target/94980] [8/9/10/11 Regression] ICE: verify_gimple failed: position plus size exceeds size of referenced object in 'bit_field_ref' with -mavx512vl

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94980

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Sandiford <rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:4c0283b9ad75b128b79c507d78d678123fe9f471

commit r11-313-g4c0283b9ad75b128b79c507d78d678123fe9f471
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Tue May 12 09:01:13 2020 +0100

    tree-vect-generic: Fix bitfield widths [PR94980 3/3]

    This third patch of three actually fixes the PR.  We were using
    8-bit BIT_FIELD_REFs to access single-bit elements, and multiplying
    the vector index by 8 bits rather than 1 bit.

    2020-05-12  Richard Sandiford  <richard.sandiford@arm.com>

    gcc/
            PR tree-optimization/94980
            * tree-vect-generic.c (expand_vector_comparison): Use
            vector_element_bits_tree to get the element size in bits,
            rather than using TYPE_SIZE.
            (expand_vector_condition, vector_element): Likewise.

    gcc/testsuite/
            PR tree-optimization/94980
            * gcc.target/i386/pr94980.c: New test.

[Bug target/94980] [8/9/10/11 Regression] ICE: verify_gimple failed: position plus size exceeds size of referenced object in 'bit_field_ref' with -mavx512vl

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94980

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Fixed on master.  As mentioned on-list, GCC 7 generated wrong code
instead of ICEing, and there's a danger GCC 8+ could regress to that
in other cases if we backported the patches.  So instead it seems
more appropriate to leave the branches alone for now and perhaps
revisit if a real-world test case comes along.  We might by that
time have found more places that need similar fixes.