[Bug regression/95025] New: [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[Bug regression/95025] New: [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

            Bug ID: 95025
           Summary: [11 Regression] ICE in execute_sm_exit at
                    gcc/tree-ssa-loop-im.c:2224 since
                    r11-161-g283cb9ea6293e813
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: regression
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: rguenth at gcc dot gnu.org
  Target Milestone: ---

The following is causing ICE:

$ cat lim.ii
struct a {
  int b;
} * c;
struct d {
  d *e;
};
struct f {
  bool done;
  d *g;
};
int h;
int i(f *j) {
  if (j->g) {
    j->g = j->g->e;
    return h;
  }
  j->done = true;
  return 0;
}
void k(bool j) { c->b = j; }
void l() {
  f a;
  for (; !(&a)->done; i(&a))
    k(true);
}

$ ./xgcc -B. /tmp/tree-into-ssa.ii -c -O2 -fsanitize=address
during GIMPLE pass: lim
../../gcc/tree-into-ssa.c: In member function ‘virtual edge_def*
mark_def_dom_walker::before_dom_children(basic_block)’:
../../gcc/tree-into-ssa.c:2336:1: internal compiler error: Segmentation fault
 2336 | mark_def_dom_walker::before_dom_children (basic_block bb)
      | ^~~~~~~~~~~~~~~~~~~
0xf217cf crash_signal
        ../../gcc/toplev.c:328
0x1089b3e execute_sm_exit
        ../../gcc/tree-ssa-loop-im.c:2224
0x108fa03 hoist_memory_references
        ../../gcc/tree-ssa-loop-im.c:2562
0x108fa03 store_motion_loop
        ../../gcc/tree-ssa-loop-im.c:2824
0x108e94d store_motion_loop
        ../../gcc/tree-ssa-loop-im.c:2830
0x1090d3a store_motion
        ../../gcc/tree-ssa-loop-im.c:2845
0x1090d3a tree_ssa_lim
        ../../gcc/tree-ssa-loop-im.c:3065
0x1090d3a execute
        ../../gcc/tree-ssa-loop-im.c:3115

[Bug regression/95025] [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |10.1.0
            Version|10.0                        |11.0
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
      Known to fail|                            |11.0
   Last reconfirmed|                            |2020-05-09
   Target Milestone|---                         |11.0

[Bug regression/95025] [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

David Binderman <dcb314 at hotmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dcb314 at hotmail dot com

--- Comment #1 from David Binderman <dcb314 at hotmail dot com> ---
I see this bug also. Another C test case is available on request.

[Bug regression/95025] [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

[Bug regression/95025] [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to David Binderman from comment #1)
> I see this bug also. Another C test case is available on request.

Please attach it.

[Bug regression/95025] [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

--- Comment #3 from David Binderman <dcb314 at hotmail dot com> ---
Created attachment 48504
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48504&action=edit
C source code

[Bug regression/95025] [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to David Binderman from comment #3)
> Created attachment 48504 [details]
> C source code

I'm gonna reduce that.

[Bug regression/95025] [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
$ cat pr95025.c
static int a;
short b;
int *c;
void d() {
  for (;; a -= 1)
    for (; b; b += 1) {
      *c ^= 5;
      if (a)
        return;
    }
}

$ gcc -O2 -c pr95025.c -Werror
during GIMPLE pass: lim
pr95025.c: In function ‘d’:
pr95025.c:4:6: internal compiler error: Segmentation fault
    4 | void d() {
      |      ^
0xe36b0f crash_signal
        /home/marxin/Programming/gcc/gcc/toplev.c:328
0x7ffff78fef1f ???
       
/usr/src/debug/glibc-2.31-4.1.x86_64/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
0x72dd2c execute_sm_exit
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-im.c:2224
0xf71d25 hoist_memory_references
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-im.c:2562
0xf71d25 store_motion_loop
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-im.c:2824
0xf70a21 store_motion_loop
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-im.c:2830
0xf72cca store_motion
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-im.c:2845
0xf72cca tree_ssa_lim
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-im.c:3065
0xf72cca execute
        /home/marxin/Programming/gcc/gcc/tree-ssa-loop-im.c:3115
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug regression/95025] [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

--- Comment #6 from David Binderman <dcb314 at hotmail dot com> ---
My creduced version is similar:

static a;
short b;
*c;
d() {
  for (;; a--)
    for (; b; b++) {
      *c = 5;
      if (a)
        return;
    }
}

Flag -O2 on x86_64 required. The code seems to compile ok
on the raspberry pi.

[Bug regression/95025] [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:b6ff3ddecfa93d53867afaaa078f85fc848abbbd

commit r11-272-gb6ff3ddecfa93d53867afaaa078f85fc848abbbd
Author: Richard Biener <rguenther@suse.de>
Date:   Fri May 8 12:03:30 2020 +0200

    tree-optimization/94988 - enhance SM some more

    This enhances store-order preserving store motion to handle the case
    of non-invariant dependent stores in the sequence of unconditionally
    executed stores on exit by re-issueing them as part of the sequence
    of stores on the exit.  This fixes the observed regression of
    gcc.target/i386/pr64110.c which relies on store-motion of 'b'
    for a loop like

      for (int i = 0; i < j; ++i)
        *b++ = x;

    where for correctness we now no longer apply store-motion.  With
    the patch we emit the correct

      tem = b;
      for (int i = 0; i < j; ++i)
        {
          tem = tem + 1;
          *tem = x;
        }
      b = tem;
      *tem = x;

    preserving the original order of stores.  A testcase reflecting
    the miscompilation done by earlier GCC is added as well.

    This also fixes the reported ICE in PR95025 and adds checking code
    to catch it earlier - the issue was not-supported refs propagation
    leaving stray refs in the sequence.

    2020-05-11  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/94988
            PR tree-optimization/95025
            * tree-ssa-loop-im.c (seq_entry): Make a struct, add from.
            (sm_seq_push_down): Take extra parameter denoting where we
            moved the ref to.
            (execute_sm_exit): Re-issue sm_other stores in the correct
            order.
            (sm_seq_valid_bb): When always executed, allow sm_other to
            prevail inbetween sm_ord and record their stored value.
            (hoist_memory_references): Adjust refs_not_supported propagation
            and prune sm_other from the end of the ordered sequences.

            * gcc.dg/torture/pr94988.c: New testcase.
            * gcc.dg/torture/pr95025.c: Likewise.
            * gcc.dg/torture/pr95045.c: Likewise.
            * g++.dg/asan/pr95025.C: New testcase.

[Bug regression/95025] [11 Regression] ICE in execute_sm_exit at gcc/tree-ssa-loop-im.c:2224 since r11-161-g283cb9ea6293e813

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95025

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.