[Bug tree-optimization/97317] New: [11 Regression] ICE in verify_range, at value-range.cc:369

[Bug tree-optimization/97317] New: [11 Regression] ICE in verify_range, at value-range.cc:369

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97317

            Bug ID: 97317
           Summary: [11 Regression] ICE in verify_range, at
                    value-range.cc:369
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: acoplan at gcc dot gnu.org
  Target Milestone: ---

For the following testcase:

struct a {
  unsigned c : 17;
};
struct a b;
int d(void) {
  short e = b.c;
  return e ? 0 : b.c;
}

AArch64 GCC ICEs at -O2 with:

during GIMPLE pass: evrp
test.c: In function 'd':
test.c:8:1: internal compiler error: in verify_range, at value-range.cc:369
    8 | }
      | ^
0x1126f4a irange::verify_range()
        /home/alecop01/toolchain/src/gcc/gcc/value-range.cc:369
0x1127050 irange::irange_set(tree_node*, tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/value-range.cc:172
0x1127ef5 irange::set(tree_node*, tree_node*, value_range_kind)
        /home/alecop01/toolchain/src/gcc/gcc/value-range.cc:226
0x19ec5cd operator_cast::op1_range(irange&, tree_node*, irange const&, irange
const&) const
        /home/alecop01/toolchain/src/gcc/gcc/range-op.cc:1847
0x1a85dc7 gimple_range_calc_op1(irange&, gimple const*, irange const&, irange
const&)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range.cc:333
0x1a9563a gori_compute::compute_name_range_op(irange&, gimple*, irange const&,
tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range-gori.cc:490
0x1a9886a gori_compute::compute_operand_range(irange&, gimple*, irange const&,
tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range-gori.cc:590
0x1a990b3 gori_compute_cache::compute_operand_range(irange&, gimple*, irange
const&, tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range-gori.cc:1276
0x1a95d23 gori_compute::compute_operand1_range(irange&, gimple*, irange const&,
tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range-gori.cc:903
0x1a989bc gori_compute::compute_operand_range(irange&, gimple*, irange const&,
tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range-gori.cc:602
0x1a990b3 gori_compute_cache::compute_operand_range(irange&, gimple*, irange
const&, tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range-gori.cc:1276
0x1a9614a gori_compute::outgoing_edge_range_p(irange&, edge_def*, tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range-gori.cc:1001
0x1a90b9e ranger_cache::iterative_cache_update(tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range-cache.cc:636
0x1a91933 ranger_cache::fill_block_cache(tree_node*, basic_block_def*,
basic_block_def*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range-cache.cc:808
0x1a91dab ranger_cache::block_range(irange&, basic_block_def*, tree_node*,
bool)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range-cache.cc:589
0x1a84f0c gimple_ranger::range_on_entry(irange&, basic_block_def*, tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range.cc:875
0x1a89634 gimple_ranger::range_of_expr(irange&, tree_node*, gimple*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range.cc:846
0x1a8dba1 gimple_ranger::range_of_range_op(irange&, gimple*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range.cc:418
0x1a8ddb6 gimple_ranger::calc_stmt(irange&, gimple*, tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range.cc:369
0x1a8e70d gimple_ranger::range_of_stmt(irange&, gimple*, tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-range.cc:952
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/97317] [11 Regression] ICE in verify_range, at value-range.cc:369

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97317

Alex Coplan <acoplan at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Build|                            |x86_64-linux-gnu
   Target Milestone|---                         |11.0
           Keywords|                            |ice-on-valid-code
      Known to fail|                            |11.0
               Host|                            |x86_64-linux-gnu
             Target|                            |aarch64-elf

[Bug tree-optimization/97317] [11 Regression] ICE in verify_range, at value-range.cc:369

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97317

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-10-07
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org
           Priority|P3                          |P1
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed on x86_64-linux-gnu target as well.

[Bug tree-optimization/97317] [11 Regression] ICE in verify_range, at value-range.cc:369

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97317

--- Comment #2 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
operator_cast::op1_range() is creating a range with swapped operands here:

          // And union this with the entire outer types negative range.         
          int_range_max neg (type,
                             wi::min_value (TYPE_PRECISION (type),
                                            SIGNED),
                             lim - 1);


(gdb) ptg type
<unnamed-unsigned:17>

(gdb) dd wmin
[0xffffffffffff0000], precision = 17
(gdb) dd wmax
[0xffff], precision = 17

This is an unsigned bit field, which I can never get right.  Andrew, should we
be creating a min in SIGNED precision here?

[Bug tree-optimization/97317] [11 Regression] ICE in verify_range, at value-range.cc:369

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97317

--- Comment #3 from Andrew Macleod <amacleod at redhat dot com> ---
Created attachment 49331
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49331&action=edit
patch to calculate negative side properly

This is actually due to not handling a cast very well when the precision of the
RHS is only 1 greater than the precision of the LHS.

lhs = (cast) RHS

we calculate the value of RHS by treating LHS as an unsigned, and
1) adding in all the ranges of LHS as positive ranges
2) adding in all the LHS values  as negative values
3) filling in all the other ranges in RHS between those negative and positive
values.   ie, all the various upper bits in RHS can be on or off... 

THe code breaks down when the precision of the RHS is off by one. when
calculating those negative values in 3), there wasn't a expectation that the
sign bit *is* basically the entire range, so when it was trying to calculate
the range o fthose bits, it was trying to create a nonsensical  range.

This patch fixes that particular problem, but further examination shows we
arent producing ranges as good as we could.. so I will continue delving into
it.

[Bug tree-optimization/97317] [11 Regression] ICE in verify_range, at value-range.cc:369

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97317

David Binderman <dcb314 at hotmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dcb314 at hotmail dot com

--- Comment #4 from David Binderman <dcb314 at hotmail dot com> ---
I see this one also. I am reducing some C++ code from a build
of the qt3 package on x86_64 linux.

[Bug tree-optimization/97317] [11 Regression] ICE in verify_range, at value-range.cc:369

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97317

--- Comment #5 from David Binderman <dcb314 at hotmail dot com> ---
Reduced C++ source code is

class a {
public:
  struct b {
    int *c;
  };
  enum { j = 1 } e : 2;
  struct {
    b c;
  } d;
  bool f() const { return e & j; }
  int *g() const;
};
int *a::g() const { return f() ? d.c.c : 0; }
a h;
void i() {
  h.g();
  h.f();
}

Flag -O2 required.

[Bug tree-optimization/97317] [11 Regression] ICE in verify_range, at value-range.cc:369

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97317

--- Comment #6 from Andrew Macleod <amacleod at redhat dot com> ---
Thanks,  yeah this is the same issue and the patch should fix it..?


the precision difference of one this time is 1 bit (bool) and a 2 bit object...

  <unnamed-unsigned:2> _5;
  bool _6;
<..>
_6 = (bool) _5;

[Bug tree-optimization/97317] [11 Regression] ICE in verify_range, at value-range.cc:369

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97317

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Aldy Hernandez <aldyh@gcc.gnu.org>:

https://gcc.gnu.org/g:1cde5d85bec20877bed063fc0046b9885231a0ae

commit r11-3746-g1cde5d85bec20877bed063fc0046b9885231a0ae
Author: Andrew MacLeod <amacleod@redhat.com>
Date:   Fri Oct 9 10:46:50 2020 +0200

    Fix for PR97317.

    gcc/ChangeLog:

            PR tree-optimization/97317
            * range-op.cc (operator_cast::op1_range): Handle casts where the
precision
            of the RHS is only 1 greater than the precision of the LHS.

    gcc/testsuite/ChangeLog:
            * gcc.dg/pr97317.c: New test.

[Bug tree-optimization/97317] [11 Regression] ICE in verify_range, at value-range.cc:369

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97317

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #8 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
fixed