From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 2CF993950C08; Wed, 24 Feb 2021 15:17:36 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 2CF993950C08 From: "cvs-commit at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug tree-optimization/99220] [11 Regression] ICE during vectorization when multiple instances do the same calculation but have different num lanes Date: Wed, 24 Feb 2021 15:17:36 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: tree-optimization X-Bugzilla-Version: 11.0 X-Bugzilla-Keywords: ice-on-valid-code X-Bugzilla-Severity: normal X-Bugzilla-Who: cvs-commit at gcc dot gnu.org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: tnfchris at gcc dot gnu.org X-Bugzilla-Target-Milestone: 11.0 X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Feb 2021 15:17:36 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D99220 --- Comment #2 from CVS Commits --- The master branch has been updated by Tamar Christina : https://gcc.gnu.org/g:6c35e79b47ab582e18d851f6c5df776bac766eaf commit r11-7359-g6c35e79b47ab582e18d851f6c5df776bac766eaf Author: Tamar Christina Date: Wed Feb 24 15:16:23 2021 +0000 slp: fix accidental resource re-use of slp_tree (PR99220) The attached testcase shows a bug where two nodes end up with the same pointer. During the loop that analyzes all the instances in optimize_load_redistribution_1 we do if (value) { SLP_TREE_REF_COUNT (value)++; SLP_TREE_CHILDREN (root)[i] =3D value; vect_free_slp_tree (node); } when doing a replacement. When this is done and the refcount for the n= ode reaches 0, the node is removed, which allows the libc to return the poi= nter again in the next call to new, which it does.. First instance note: node 0x5325f48 (max_nunits=3D1, refcnt=3D2) note: op: VEC_PERM_EXPR note: { } note: lane permutation { 0[0] 1[1] 0[2] 1[3] } note: children 0x5325db0 0x5325200 Second instance note: node 0x5325f48 (max_nunits=3D1, refcnt=3D1) note: op: VEC_PERM_EXPR note: { } note: lane permutation { 0[0] 1[1] } note: children 0x53255b8 0x5325530 This will end up with the illegal construction of note: node 0x53258e8 (max_nunits=3D2, refcnt=3D2) note: op template: slp_patt_57 =3D .COMPLEX_MUL (_16, _16); note: stmt 0 _16 =3D _14 - _15; note: stmt 1 _23 =3D _17 + _22; note: children 0x53257d8 0x5325d28 note: node 0x53257d8 (max_nunits=3D2, refcnt=3D3) note: op template: l$b_4 =3D MEM[(const struct a &)_3].b; note: stmt 0 l$b_4 =3D MEM[(const struct a &)_3].b; note: stmt 1 l$c_5 =3D MEM[(const struct a &)_3].c; note: load permutation { 0 1 } note: node 0x5325d28 (max_nunits=3D2, refcnt=3D8) note: op template: l$b_4 =3D MEM[(const struct a &)_3].b; note: stmt 0 l$b_4 =3D MEM[(const struct a &)_3].b; note: stmt 1 l$c_5 =3D MEM[(const struct a &)_3].c; note: stmt 2 l$b_4 =3D MEM[(const struct a &)_3].b; note: stmt 3 l$c_5 =3D MEM[(const struct a &)_3].c; note: load permutation { 0 1 0 1 } To prevent this we remove the node from the load_map if it's about to be deleted. gcc/ChangeLog: PR tree-optimization/99220 * tree-vect-slp.c (optimize_load_redistribution_1): Remove node from cache when it's about to be deleted. gcc/testsuite/ChangeLog: PR tree-optimization/99220 * g++.dg/vect/pr99220.cc: New test.=