[Bug tree-optimization/97609] New: [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[Bug tree-optimization/97609] New: [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

            Bug ID: 97609
           Summary: [11 Regression] ICE: tree check: expected tree that
                    contains 'decl common' structure, have 'component_ref'
                    in tree_could_trap_p, at tree-eh.c:2708
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

Created attachment 49457
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49457&action=edit
Testcase

g++-11.0.0-alpha20201025 snapshot (g:308e40331f9d2820f8286769b5fc764671187364)
ICEs when compiling the attached testcase, reduced from
test/std/containers/sequences/forwardlist/forwardlist.ops/unique.pass.cpp from
the libcxx 10.0.1 test suite, w/ -O2 -fno-tree-fre -fnon-call-exceptions:

% g++-11.0.0 -O2 -fno-tree-fre -fnon-call-exceptions -c d1sutzlp.cpp
during GIMPLE pass: evrp
d1sutzlp.cpp: In member function 'forward_list< <template-parameter-1-1>,
<template-parameter-1-2> >::__remove_return_type forward_list<
<template-parameter-1-1>, <template-parameter-1-2> >::unique(_BinPred) [with
_BinPred = int; <template-parameter-1-1> = int; <template-parameter-1-2> =
int]':
d1sutzlp.cpp:41:1: internal compiler error: tree check: expected tree that
contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at
tree-eh.c:2708
   41 | }
      | ^
0x7dbdc8 tree_contains_struct_check_failed(tree_node const*,
tree_node_structure_enum, char const*, int, char const*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree.c:9903
0x780afc contains_struct_check(tree_node*, tree_node_structure_enum, char
const*, int, char const*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree.h:3417
0x780afc tree_could_trap_p(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree-eh.c:2708
0x10875f4 stmt_could_throw_1_p
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree-eh.c:2868
0x10875f4 stmt_could_throw_p(function*, gimple*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree-eh.c:2922
0x1088fe5 stmt_could_throw_p(function*, gimple*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree-eh.c:2894
0x1088fe5 stmt_can_throw_internal(function*, gimple*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree-eh.c:2996
0x12cdff5 infer_value_range(gimple*, tree_node*, tree_code*, tree_node**)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree-vrp.c:1331
0x12cdff5 infer_value_range(gimple*, tree_node*, tree_code*, tree_node**)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree-vrp.c:1317
0x19b157f non_null_ref::process_name(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/gimple-range-cache.cc:102
0x19b1694 non_null_ref::non_null_deref_p(tree_node*, basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/gimple-range-cache.cc:60
0x19b1694 non_null_ref::non_null_deref_p(tree_node*, basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/gimple-range-cache.cc:53
0x19b3a78 ranger_cache::fill_block_cache(tree_node*, basic_block_def*,
basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/gimple-range-cache.cc:772
0x19b3efd ranger_cache::block_range(irange&, basic_block_def*, tree_node*,
bool)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/gimple-range-cache.cc:589
0x19ac7e4 gimple_ranger::range_on_entry(irange&, basic_block_def*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/gimple-range.cc:939
0x19ad13b gimple_ranger::range_of_expr(irange&, tree_node*, gimple*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/gimple-range.cc:910
0x130e921 range_query::value_of_expr(tree_node*, gimple*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/value-query.cc:86
0x19bb0c1 hybrid_folder::value_of_expr(tree_node*, gimple*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/gimple-ssa-evrp.c:235
0x11c2784 substitute_and_fold_engine::replace_uses_in(gimple*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree-ssa-propagate.c:871
0x11c2aab substitute_and_fold_dom_walker::before_dom_children(basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201025/work/gcc-11-20201025/gcc/tree-ssa-propagate.c:1141

[Bug tree-optimization/97609] [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aldyh at gcc dot gnu.org
           Priority|P3                          |P1
   Target Milestone|---                         |11.0

[Bug tree-optimization/97609] [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2020-10-28
                 CC|                            |amacleod at redhat dot com

--- Comment #1 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
confirmed

[Bug tree-optimization/97609] [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

--- Comment #2 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
tl;dr: substitute_and_fold_engine::replace_uses_in() creates invalid gimple, so
when its loop goes on to request a range (value_of_expr), the ranger may see
invalid IL and die an ungraceful death.

The long story:

We are calling substitute_and_fold_engine::replace_uses_in() on the following
statement:

  <bb 3> :
  SR.2_9 = &__to_destroy._M_head;
  SR.1_10 = SR.2_9;
  __pos$_M_node_6 = SR.1_10;
  _11 = __pos$_M_node_6;
  _11->_M_next = __keep_12(D);  <-- HERE HERE

For _11, the call to value_of_expr() in replace_uses_in() returns:

  &__to_destroy._M_head;

which is propagated with propagate_value() and creates invalid gimple in the
process:

  __to_destroy._M_head._M_next = __keep_12(D);

The next time in the loop in replace_uses_in, we ask for
value_of_expr(__keep_12(D)), which dies deep in the call chain, because the IL
borked.

[Bug tree-optimization/97609] [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

--- Comment #3 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
And the reason this was working before is two-fold.

First, value_of_expr() in legacy evrp won't look at broken gimple, so the
request for __keep_12(D) in the following statement actually succeeds:

  __to_destroy._M_head._M_next = __keep_12(D);

Well... returns NULL.

Second, after replace_uses_in() succeeds, the gimple folder fixes the crappy IL
by transforming:

  __to_destroy._M_head._M_next = __keep_12(D);

into:

  MEM[(struct _Fwd_list_node_base *)&__to_destroy]._M_next = __keep_12(D);


So basically this worked before because even though
substitute_and_fold_engine::replace_uses_in() created invalid gimple, it
depended on the gimple folder to clean-up the nonsense after the fact.  How
stupid is that? :)

[Bug tree-optimization/97609] [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

--- Comment #4 from Andrew Macleod <amacleod at redhat dot com> ---
This worked OK because the code does:

      /* Replace real uses in the statement.  */
      did_replace |= substitute_and_fold_engine->replace_uses_in (stmt);

      gimple_stmt_iterator prev_gsi = i;
      gsi_prev (&prev_gsi);

      /* If we made a replacement, fold the statement.  */
      if (did_replace)
        {
          fold_stmt (&i, follow_single_use_edges);
          stmt = gsi_stmt (i);
          gimple_set_modified (stmt, true);
        }

basically replace uses, and then folded the statement to make it right.

Enter the hybrid folder... and if you look closely at 
substitute_and_fold_engine::replace_uses_in (), you will see:

  FOR_EACH_SSA_USE_OPERAND (use, stmt, iter, SSA_OP_USE)
    {
      tree tuse = USE_FROM_PTR (use);
      tree val = value_of_expr (tuse, stmt);

<...>


The statement giving us grief is:
_11->_M_next = __keep_12(D);
where EVRP has decided that _11 can be replaced by  &__to_destroy._M_head

replace_uses_in () loops thru the SSA_NAMEs in the stmt.
THe first one is _11, which it proceeds to replace with &__to_destroy._M_head,
producing our problematic

  __to_destroy._M_head._M_next = __keep_12(D);

but before returning and calling fold_stmt to fix it up, it looks at the next
ssa_name, __keep_12 and calls 
   tree val = value_of_expr (tuse, stmt);
which causes a ranger lookup for __keep_12 on this stmt.

Normally, that wouldn't be a big deal either because we don't need to look at
this statement, but because its a pointer, it triggers a call to the rangers
non-null pointer tracking code.

__keep_12 has never been "checked" before, so the non-null pointer code goes
and quickly visits each use to globally mark which blocks trigger a non-null
deference for future use...   and voila...
it visits this malformed statement and dies.

Now. what to do about it.  I don't think replace_uses is doing anything wrong.
This is purely the fault of non-null deref tracking, which I plan to revamp
before the next stage 1...

Let me think...

[Bug tree-optimization/97609] [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

--- Comment #5 from Andrew Macleod <amacleod at redhat dot com> ---
Created attachment 49460
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49460&action=edit
call infer_non_null directly

Looking closer at the non-null deref calls, the problem was deep in
stmt_ends_bb_p() which cares about trapping statements and such... 

The general routine looks closely to see if the stmt is the last stmt in a
block, and we have no need to do that.

This patch is currently in testing, and simply calls infer_nonnull_range()
directly.   Probably should have been doing that from the start since thats the
actual question being asked.

[Bug tree-optimization/97609] [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Andrew Macleod <amacleod@gcc.gnu.org>:

https://gcc.gnu.org/g:0162d00d12be24ee3f02ce876adafeaa91c6f7f9

commit r11-4515-g0162d00d12be24ee3f02ce876adafeaa91c6f7f9
Author: Andrew MacLeod <amacleod@redhat.com>
Date:   Wed Oct 28 16:41:15 2020 -0400

    Call infer_non_null() directly when checking for non-null.

    Simply call infer_non_null directly and avoid uneccessary checks of
    the statement being modified.

            gcc/
            PR tree-optimization/97609
            * gimple-range-cache.cc (non_null_ref::process_name): Call
            infer_nonnull_range directly instead of infer_value_range.
            gcc/testsuite/
            * g++.dg/pr97609.C: New.

[Bug tree-optimization/97609] [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
Can it be closed as fixed?

[Bug tree-optimization/97609] [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[aldyh at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

--- Comment #8 from Aldy Hernandez <aldyh at redhat dot com> ---
Yes.

On Thu, Oct 29, 2020, 09:47 marxin at gcc dot gnu.org <
gcc-bugzilla@gcc.gnu.org> wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609
>
> Martin Liška <marxin at gcc dot gnu.org> changed:
>
>            What    |Removed                     |Added
>
> ----------------------------------------------------------------------------
>                  CC|                            |marxin at gcc dot gnu.org
>
> --- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
> Can it be closed as fixed?
>
> --
> You are receiving this mail because:
> You are on the CC list for the bug.
>
>

[Bug tree-optimization/97609] [11 Regression] ICE: tree check: expected tree that contains 'decl common' structure, have 'component_ref' in tree_could_trap_p, at tree-eh.c:2708

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #9 from Martin Liška <marxin at gcc dot gnu.org> ---
Then fixed.