[Bug tree-optimization/99726] New: [10/11 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[Bug tree-optimization/99726] New: [10/11 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

            Bug ID: 99726
           Summary: [10/11 Regression] ICE in
                    create_intersect_range_checks_index, at
                    tree-data-ref.c:1855 since
                    r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: rsandifo at gcc dot gnu.org
  Target Milestone: ---

Since the revision the following is causing ICE:

$  cat ~/Programming/testcases/ice.i
extern int aa[][1024];
int aa_4294967295_1;
long foo4_n, foo4_m;
unsigned int main_i;
void main() {
  {
    unsigned j;
    for (; main_i < foo4_m; main_i++) {
      j = 1;
      for (; j < foo4_n; j++)
        aa[main_i][j] = aa_4294967295_1 * aa[main_i - 1][j + 1];
    }
  }
}

$ gcc ~/Programming/testcases/ice.i -flive-patching=inline-clone -mavx512vbmi2
-O2 -floop-nest-optimize -ftree-loop-vectorize -ftrapv -m32
during GIMPLE pass: vect
/home/marxin/Programming/testcases/ice.i: In function ‘main’:
/home/marxin/Programming/testcases/ice.i:5:6: internal compiler error: in
create_intersect_range_checks_index, at tree-data-ref.c:2197
    5 | void main() {
      |      ^~~~
0x842c04 create_intersect_range_checks_index
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:2197
0x19d8dcc create_intersect_range_checks
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:2580
0x19d8dcc create_runtime_alias_checks(loop*, vec<dr_with_seg_len_pair_t,
va_heap, vl_ptr>*, tree_node**)
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:2663
0x111a23e vect_create_cond_for_alias_checks(_loop_vec_info*, tree_node**)
        /home/marxin/Programming/gcc/gcc/tree-vect-loop-manip.c:3329
0x111bd45 vect_loop_versioning(_loop_vec_info*, gimple*)
        /home/marxin/Programming/gcc/gcc/tree-vect-loop-manip.c:3418
0x11138a6 vect_transform_loop(_loop_vec_info*, gimple*)
        /home/marxin/Programming/gcc/gcc/tree-vect-loop.c:9459
0x1140fff try_vectorize_loop_1
        /home/marxin/Programming/gcc/gcc/tree-vectorizer.c:1104
0x1141ce0 vectorize_loops()
        /home/marxin/Programming/gcc/gcc/tree-vectorizer.c:1243
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/99726] [10/11 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |9.3.0
   Last reconfirmed|                            |2021-03-23
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Target Milestone|---                         |10.3
      Known to fail|                            |10.2.0, 11.0

[Bug tree-optimization/99726] [10/11 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/99726] [10/11 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Slightly cleaned up testcase:
extern int a[256][1024];
int b;
long c, d;
unsigned int e;

int
main ()
{
  for (; e < d; e++)
    for (unsigned j = 1; j < c; j++)
      a[e][j] = b * a[e - 1][j + 1];
  return 0;
}

[Bug tree-optimization/99726] [10/11 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
And -flive-patching=inline-clone -mavx512f -O2 -floop-nest-optimize
-ftree-loop-vectorize -ftrapv -m32
is sufficient to trigger it.
I'm afraid I'm lost in what exactly the code wants to do.
dr_a.dr:
#(Data Ref: 
#  bb: 57 
#  stmt: _231 = a[_238][_242];
#  ref: a[_238][_242];
#  base_object: a;
#  Access function 0: {(unsigned int) (_239 - graphite_IV.18_206) + 2, +,
4294967295}_6
#  Access function 1: {((unsigned int) (graphite_IV.18_206 + _234) + e.6_19) +
4294967295, +, 1}_6
#)
dr_b.dr:
#(Data Ref: 
#  bb: 57 
#  stmt: a[_250][_254] = _243;
#  ref: a[_250][_254];
#  base_object: a;
#  Access function 0: {(unsigned int) (_251 - graphite_IV.18_206) + 1, +,
4294967295}_6
#  Access function 1: {(unsigned int) (graphite_IV.18_206 + _247) + e.6_19, +,
1}_6
#)

DR_STEP (dr_a.dr) == DR_STEP (dr_b.dr) == 4092, so it is not neg_step:
  bool neg_step = tree_int_cst_compare (DR_STEP (dr_a.dr), size_zero_node) < 0;

      /* Index must evaluate in the same direction as DR.  */
      gcc_assert (!neg_step || tree_int_cst_sign_bit (idx_step) == 1);
but this doesn't check anything if neg_step is false, rather than ensuring it
has the same direction.
And
      offset_int abs_idx_step = offset_int::from (wi::to_wide (idx_step),
                                                  SIGNED);
      if (neg_step)
        abs_idx_step = -abs_idx_step;
offset_int::from will treat the unsigned int idx_step of -1U as -1 and the
asserts fail because it is not non-negative.

[Bug tree-optimization/99726] [10/11 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rsandifo at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #3 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Mine.

[Bug tree-optimization/99726] [10/11 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Sandiford <rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:b5c7accfb56a7347008f629be4c7344dd849b1b1

commit r11-7935-gb5c7accfb56a7347008f629be4c7344dd849b1b1
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Wed Mar 31 19:34:01 2021 +0100

    data-ref: Tighten index-based alias checks [PR99726]

    create_intersect_range_checks_index tries to create a runtime
    alias check based on index comparisons.  It looks through the
    access functions for the two DRs to find a SCEV for the loop
    that is being versioned and converts a DR_STEP-based check
    into an index-based check.

    However, there isn't any reliable sign information in the types,
    so the code expects the value of the IV step (when interpreted as
    signed) to be negative iff the DR_STEP (when interpreted as signed)
    is negative.

    r10-4762 added another assert related to this assumption and the
    assert fired for the testcase in the PR.  The sign of the IV step
    didn't match the sign of the DR_STEP.

    I think this is actually showing what was previously a wrong-code bug.
    The signs didn't match because the DRs contained *two* access function
    SCEVs for the loop being versioned.  It doesn't look like the code
    is set up to deal with this, since it checks each access function
    independently and treats it as the sole source of DR_STEP.

    The patch therefore moves the main condition out of the loop.
    This also has the advantage of not building a tree for one access
    function only to throw it away if we find an inner function that
    makes the comparison invalid.

    gcc/
            PR tree-optimization/99726
            * tree-data-ref.c (create_intersect_range_checks_index): Bail
            out if there is more than one access function SCEV for the loop
            being versioned.

    gcc/testsuite/
            PR tree-optimization/99726
            * gcc.target/i386/pr99726.c: New test.

[Bug tree-optimization/99726] [10 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[10/11 Regression] ICE in   |[10 Regression] ICE in
                   |create_intersect_range_chec |create_intersect_range_chec
                   |ks_index, at                |ks_index, at
                   |tree-data-ref.c:1855 since  |tree-data-ref.c:1855 since
                   |r10-4762-gf9d6338bd15ce1fae |r10-4762-gf9d6338bd15ce1fae
                   |36bf25d3a0545e9678ddc58     |36bf25d3a0545e9678ddc58

--- Comment #5 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Fixed on trunk so far.

[Bug tree-optimization/99726] [10 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:e53c0696113cced90561e79ade27445f6c0926d0

commit r11-7957-ge53c0696113cced90561e79ade27445f6c0926d0
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Fri Apr 2 10:07:50 2021 +0200

    testsuite: Fix up gcc.target/i386/pr99726.c test [PR99726]

    -m32 shouldn't be used in gcc.target/i386/ testcases, people do
    test with -m32/-m64 to get 32-bit compilation tested.
    And, -floop-nest-optimize is a graphite optimization, so might not
    be enabled in all gcc builds.

    2021-04-02  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/99726
            * gcc.target/i386/pr99726.c: Remove -m32 from dg-options.  Move
            -floop-nest-optimize to dg-additional-options guarded on fgraphite
            effective target.

[Bug tree-optimization/99726] [10 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.3                        |10.4

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10.3 is being released, retargeting bugs to GCC 10.4.

[Bug tree-optimization/99726] [10 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Sandiford
<rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:7e2db68a77fb211898a024c5a7ad7c4449c7e355

commit r10-9749-g7e2db68a77fb211898a024c5a7ad7c4449c7e355
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Fri Apr 23 10:09:38 2021 +0100

    data-ref: Tighten index-based alias checks [PR99726]

    create_intersect_range_checks_index tries to create a runtime
    alias check based on index comparisons.  It looks through the
    access functions for the two DRs to find a SCEV for the loop
    that is being versioned and converts a DR_STEP-based check
    into an index-based check.

    However, there isn't any reliable sign information in the types,
    so the code expects the value of the IV step (when interpreted as
    signed) to be negative iff the DR_STEP (when interpreted as signed)
    is negative.

    r10-4762 added another assert related to this assumption and the
    assert fired for the testcase in the PR.  The sign of the IV step
    didn't match the sign of the DR_STEP.

    I think this is actually showing what was previously a wrong-code bug.
    The signs didn't match because the DRs contained *two* access function
    SCEVs for the loop being versioned.  It doesn't look like the code
    is set up to deal with this, since it checks each access function
    independently and treats it as the sole source of DR_STEP.

    The patch therefore moves the main condition out of the loop.
    This also has the advantage of not building a tree for one access
    function only to throw it away if we find an inner function that
    makes the comparison invalid.

    gcc/
            PR tree-optimization/99726
            * tree-data-ref.c (create_intersect_range_checks_index): Bail
            out if there is more than one access function SCEV for the loop
            being versioned.

    gcc/testsuite/
            PR tree-optimization/99726
            * gcc.target/i386/pr99726.c: New test.

    (cherry picked from commit b5c7accfb56a7347008f629be4c7344dd849b1b1)

[Bug tree-optimization/99726] [10 Regression] ICE in create_intersect_range_checks_index, at tree-data-ref.c:1855 since r10-4762-gf9d6338bd15ce1fae36bf25d3a0545e9678ddc58

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99726

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Fixed.