[Bug tree-optimization/96730] New: ICE on x86_64-linux-gnu with `-O1` to `-O3` (in verify_sra_access_forest, at tree-sra.c:2352)

[Bug tree-optimization/96730] New: ICE on x86_64-linux-gnu with `-O1` to `-O3` (in verify_sra_access_forest, at tree-sra.c:2352)

[cnsun at uwaterloo dot ca]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96730

            Bug ID: 96730
           Summary: ICE on x86_64-linux-gnu with `-O1` to `-O3` (in
                    verify_sra_access_forest, at tree-sra.c:2352)
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: cnsun at uwaterloo dot ca
  Target Milestone: ---

$ gcc-trunk -O1 t.c
during GIMPLE pass: esra
t.c: In function ‘d’:
t.c:10:1: internal compiler error: in verify_sra_access_forest, at
tree-sra.c:2352
   10 | int main() {}
      | ^~~
0x734000 verify_sra_access_forest(access*)
        /tmp/tmp.uva1EAuUpA-gcc-builder/gcc/gcc/tree-sra.c:2352
0xf42be2 verify_all_sra_access_forests()
        /tmp/tmp.uva1EAuUpA-gcc-builder/gcc/gcc/tree-sra.c:2403
0xf46bb4 analyze_all_variable_accesses
        /tmp/tmp.uva1EAuUpA-gcc-builder/gcc/gcc/tree-sra.c:3450
0xf470e1 perform_intra_sra
        /tmp/tmp.uva1EAuUpA-gcc-builder/gcc/gcc/tree-sra.c:4527
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
$ 
$ cat t.c
struct a {
  int b;
  int c;
} d() {
  struct a e[9];
  int f = 3362953455;
  e[f] = e[6];
  e[6].c = 1;
}
int main() {}
$ 
$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/scratch/software/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/11.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /tmp/tmp.uva1EAuUpA-gcc-builder/gcc/configure
--enable-languages=c,c++,lto --enable-multiarch
--prefix=/scratch/software/gcc-trunk --disable-bootstrap
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.0.0 20200820 (experimental) [master revision
:01cb32abf:04e23a4051fb3c049f85b9e6e2fc58f937337aff] (GCC)

[Bug tree-optimization/96730] [10/11 Regression] ICE on x86_64-linux-gnu with `-O1` to `-O3` (in verify_sra_access_forest, at tree-sra.c:2352) since r10-6320-g5b9e89c922dc2e7e

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96730

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2020-08-24
            Summary|ICE on x86_64-linux-gnu     |[10/11 Regression] ICE on
                   |with `-O1` to `-O3` (in     |x86_64-linux-gnu with `-O1`
                   |verify_sra_access_forest,   |to `-O3` (in
                   |at tree-sra.c:2352)         |verify_sra_access_forest,
                   |                            |at tree-sra.c:2352) since
                   |                            |r10-6320-g5b9e89c922dc2e7e
                 CC|                            |jamborm at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org
      Known to work|                            |9.3.0
             Status|UNCONFIRMED                 |NEW
      Known to fail|                            |10.2.0, 11.0

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Thanks for report.
Started with Martin's r10-6320-g5b9e89c922dc2e7e.

[Bug tree-optimization/96730] [10/11 Regression] ICE on x86_64-linux-gnu with `-O1` to `-O3` (in verify_sra_access_forest, at tree-sra.c:2352) since r10-6320-g5b9e89c922dc2e7e

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96730

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jamborm at gcc dot gnu.org

--- Comment #2 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Mine.

[Bug tree-optimization/96730] [10/11 Regression] ICE on x86_64-linux-gnu with `-O1` to `-O3` (in verify_sra_access_forest, at tree-sra.c:2352) since r10-6320-g5b9e89c922dc2e7e

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96730

--- Comment #3 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I have proposed a fix on the mailing list:
https://gcc.gnu.org/pipermail/gcc-patches/2020-August/552488.html

[Bug tree-optimization/96730] [10/11 Regression] ICE on x86_64-linux-gnu with `-O1` to `-O3` (in verify_sra_access_forest, at tree-sra.c:2352) since r10-6320-g5b9e89c922dc2e7e

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96730

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-checking,
                   |                            |ice-on-valid-code
           Priority|P3                          |P2
   Target Milestone|---                         |10.3
            Version|unknown                     |10.2.1

[Bug tree-optimization/96730] [10/11 Regression] ICE on x86_64-linux-gnu with `-O1` to `-O3` (in verify_sra_access_forest, at tree-sra.c:2352) since r10-6320-g5b9e89c922dc2e7e

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96730

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Jambor <jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:556600286dd312d3ddf3d673a8579576862663e3

commit r11-2838-g556600286dd312d3ddf3d673a8579576862663e3
Author: Martin Jambor <mjambor@suse.cz>
Date:   Tue Aug 25 13:33:44 2020 +0200

    sra: Bail out when encountering accesses with negative offsets (PR 96730)

    I must admit I was quite surprised to see that SRA does not disqualify
    an aggregate from any transformations when it encounters an offset for
    which get_ref_base_and_extent returns a negative offset.  It may not
    matter too much because I sure hope such programs always have
    undefined behavior (SRA candidates are local variables on stack) but
    it is probably better not to perform weird transformations on them as
    build ref model with the new build_reconstructed_reference function
    currently happily do for negative offsets (they just copy the existing
    expression which is then used as the expression of a "propagated"
    access) and of course the compiler must not ICE (as it currently does
    because the SRA forest verifier does not like the expression).

    gcc/ChangeLog:

    2020-08-24  Martin Jambor  <mjambor@suse.cz>

            PR tree-optimization/96730
            * tree-sra.c (create_access): Disqualify any aggregate with
negative
            offset access.
            (build_ref_for_model): Add assert that offset is non-negative.

    gcc/testsuite/ChangeLog:

    2020-08-24  Martin Jambor  <mjambor@suse.cz>

            PR tree-optimization/96730
            * gcc.dg/tree-ssa/pr96730.c: New test.

[Bug tree-optimization/96730] [10/11 Regression] ICE on x86_64-linux-gnu with `-O1` to `-O3` (in verify_sra_access_forest, at tree-sra.c:2352) since r10-6320-g5b9e89c922dc2e7e

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96730

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Martin Jambor
<jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:e57cdbca52df908a48bbf92c64d50dd46f483de9

commit r10-8661-ge57cdbca52df908a48bbf92c64d50dd46f483de9
Author: Martin Jambor <mjambor@suse.cz>
Date:   Tue Aug 25 16:11:56 2020 +0200

    sra: Bail out when encountering accesses with negative offsets (PR 96730)

    I must admit I was quite surprised to see that SRA does not disqualify
    an aggregate from any transformations when it encounters an offset for
    which get_ref_base_and_extent returns a negative offset.  It may not
    matter too much because I sure hope such programs always have
    undefined behavior (SRA candidates are local variables on stack) but
    it is probably better not to perform weird transformations on them as
    build ref model with the new build_reconstructed_reference function
    currently happily do for negative offsets (they just copy the existing
    expression which is then used as the expression of a "propagated"
    access) and of course the compiler must not ICE (as it currently does
    because the SRA forest verifier does not like the expression).

    gcc/ChangeLog:

    2020-08-24  Martin Jambor  <mjambor@suse.cz>

            PR tree-optimization/96730
            * tree-sra.c (create_access): Disqualify any aggregate with
negative
            offset access.
            (build_ref_for_model): Add assert that offset is non-negative.

    gcc/testsuite/ChangeLog:

    2020-08-24  Martin Jambor  <mjambor@suse.cz>

            PR tree-optimization/96730
            * gcc.dg/tree-ssa/pr96730.c: New test.

    (cherry picked from commit 556600286dd312d3ddf3d673a8579576862663e3)

[Bug tree-optimization/96730] [10/11 Regression] ICE on x86_64-linux-gnu with `-O1` to `-O3` (in verify_sra_access_forest, at tree-sra.c:2352) since r10-6320-g5b9e89c922dc2e7e

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96730

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #6 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Fixed, thanks for reporting.