[Bug tree-optimization/99947] New: [11 Regression] ICE Segmentation fault "during GIMPLE pass: vect"

[Bug tree-optimization/99947] New: [11 Regression] ICE Segmentation fault "during GIMPLE pass: vect"

[haoxintu at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99947

            Bug ID: 99947
           Summary: [11 Regression] ICE Segmentation fault "during GIMPLE
                    pass: vect"
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: haoxintu at gmail dot com
  Target Milestone: ---

Hi all.

$cat small.c
#include <stdint.h>
int a, b, d, e;
int16_t c;
void f() {
  for (; e; e++) {
    int g = 6;
    for (; g > 2; g--) {
      int i = -8;
      while (i < 20) {
        i += 5;
        a += b;
      }
      c *= d;
    }
    b--;
  }
}

$gcc -O3 small.c
during GIMPLE pass: vect
small.c: In function ‘f’:
small.c:4:6: internal compiler error: Segmentation fault
    4 | void f() {
      |      ^
0xb9f63f crash_signal
        ../../gcc/toplev.c:327
0x90d820 useless_type_conversion_p(tree_node*, tree_node*)
        ../../gcc/gimple-expr.c:71
0x103daa8 gimple_simplify_VIEW_CONVERT_EXPR
        /home/tuhaoxin/compilers/gcc/build-20210330/gcc/gimple-match.c:27761
0xf48bd2 gimple_resimplify1
        ../../gcc/gimple-match-head.c:242
0x105531e gimple_match_op::resimplify(gimple**, tree_node* (*)(tree_node*))
        ../../gcc/gimple-match-head.c:489
0x105531e gimple_simplify_MULT_EXPR
        /home/tuhaoxin/compilers/gcc/build-20210330/gcc/gimple-match.c:74302
0x1069d44 gimple_simplify(tree_code, tree_node*, tree_node*, tree_node*,
gimple**, tree_node* (*)(tree_node*))
        ../../gcc/gimple-match-head.c:717
0x915daa gimple_build(gimple**, unsigned int, tree_code, tree_node*,
tree_node*, tree_node*)
        ../../gcc/gimple-fold.c:8509
0xdb30a8 gimple_build(gimple**, tree_code, tree_node*, tree_node*, tree_node*)
        ../../gcc/gimple-fold.h:84
0xdb30a8 vectorizable_induction(_loop_vec_info*, _stmt_vec_info*, gimple**,
_slp_tree*, vec<stmt_info_for_cost, va_heap, vl_ptr>*)
        ../../gcc/tree-vect-loop.c:8231
0xda89bd vect_transform_stmt(vec_info*, _stmt_vec_info*, gimple_stmt_iterator*,
_slp_tree*, _slp_instance*)
        ../../gcc/tree-vect-stmts.c:10901
0xdd4cf8 vect_schedule_slp_node
        ../../gcc/tree-vect-slp.c:6193
0xde18a8 vect_schedule_scc
        ../../gcc/tree-vect-slp.c:6355
0xde15e9 vect_schedule_scc
        ../../gcc/tree-vect-slp.c:6336
0xde1d3b vect_schedule_slp(vec_info*, vec<_slp_instance*, va_heap, vl_ptr>)
        ../../gcc/tree-vect-slp.c:6471
0xdc4735 vect_transform_loop(_loop_vec_info*, gimple*)
        ../../gcc/tree-vect-loop.c:9535
0xdebbcc try_vectorize_loop_1
        ../../gcc/tree-vectorizer.c:1104
0xdec7b1 vectorize_loops()
        ../../gcc/tree-vectorizer.c:1243
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/home/tuhaoxin/compilers/gcc/build-20210330/libexec/gcc/x86_64-pc-linux-gnu/11.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../configure
--prefix=/home/tuhaoxin/compilers/gcc/build-20210330/ --enable-bootstrap
--enable-checking=release --enable-languages=c,c++ -disable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.0.1 20210330 (experimental) (GCC) 

Note that this issue only occurs in the trunk version, so I guess it's a
regression problem.

Reproduced in Godbolt: https://godbolt.org/z/Evh93dzM6



Thanks,
Haoxin

[Bug tree-optimization/99947] [11 Regression] ICE Segmentation fault "during GIMPLE pass: vect" since r11-4714-g092cdbd919849759

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99947

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |11.0
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
   Last reconfirmed|                            |2021-04-07
     Ever confirmed|0                           |1
      Known to work|                            |10.2.0
            Summary|[11 Regression] ICE         |[11 Regression] ICE
                   |Segmentation fault "during  |Segmentation fault "during
                   |GIMPLE pass: vect"          |GIMPLE pass: vect" since
                   |                            |r11-4714-g092cdbd919849759
             Status|UNCONFIRMED                 |NEW
           Priority|P3                          |P1
   Target Milestone|---                         |11.0

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Thanks for a nice bug report.
Started with r11-4714-g092cdbd919849759.

[Bug tree-optimization/99947] [11 Regression] ICE Segmentation fault "during GIMPLE pass: vect" since r11-4714-g092cdbd919849759

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99947

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Hum, I can't reproduce it.

[Bug tree-optimization/99947] [11 Regression] ICE Segmentation fault "during GIMPLE pass: vect" since r11-4714-g092cdbd919849759

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99947

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
There's an error reported by valgrind:

==18930== Invalid read of size 8
==18930==    at 0x11005A6: quick_push (vec.h:1023)
==18930==    by 0x11005A6: quick_push (vec.h:1875)
==18930==    by 0x11005A6: safe_push (vec.h:1888)
==18930==    by 0x11005A6: vectorizable_induction(_loop_vec_info*,
_stmt_vec_info*, gimple**, _slp_tree*, vec<stmt_info_for_cost, va_heap,
vl_ptr>*) (tree-vect-loop.c:8209)
==18930==    by 0x10F7B00: vect_transform_stmt(vec_info*, _stmt_vec_info*,
gimple_stmt_iterator*, _slp_tree*, _slp_instance*) (tree-vect-stmts.c:10901)
==18930==    by 0x11298A6: vect_schedule_slp_node(vec_info*, _slp_tree*,
_slp_instance*) (tree-vect-slp.c:6193)
==18930==    by 0x11364A2: vect_schedule_scc(vec_info*, _slp_tree*,
_slp_instance*, hash_map<_slp_tree*, slp_scc_info,
simple_hashmap_traits<default_hash_traits<_slp_tree*>, slp_scc_info> >&, int&,
vec<_slp_tree*, va_heap, vl_ptr>&) (tree-vect-slp.c:6355)
==18930==    by 0x113621F: vect_schedule_scc(vec_info*, _slp_tree*,
_slp_instance*, hash_map<_slp_tree*, slp_scc_info,
simple_hashmap_traits<default_hash_traits<_slp_tree*>, slp_scc_info> >&, int&,
vec<_slp_tree*, va_heap, vl_ptr>&) (tree-vect-slp.c:6336)
==18930==    by 0x1136ACF: vect_schedule_slp(vec_info*, vec<_slp_instance*,
va_heap, vl_ptr>) (tree-vect-slp.c:6471)
==18930==    by 0x1115717: vect_transform_loop(_loop_vec_info*, gimple*)
(tree-vect-loop.c:9535)
==18930==    by 0x1141FFF: try_vectorize_loop_1(hash_table<simduid_to_vf,
false, xcallocator>*&, unsigned int*, loop*, gimple*, gimple*)
(tree-vectorizer.c:1104)
==18930==    by 0x1142CE0: vectorize_loops() (tree-vectorizer.c:1243)
==18930==    by 0xD99CC7: execute_one_pass(opt_pass*) (passes.c:2567)
==18930==    by 0xD9A6B2: execute_pass_list_1(opt_pass*) (passes.c:2656)
==18930==    by 0xD9A6C4: execute_pass_list_1(opt_pass*) (passes.c:2657)
==18930==  Address 0x5b5dc38 is 8 bytes inside a block of size 40 free'd
==18930==    at 0x484239F: realloc (vg_replace_malloc.c:1192)
==18930==    by 0x1ADDF8D: xrealloc (xmalloc.c:179)
==18930==    by 0x1100649: reserve<tree_node*> (vec.h:290)
==18930==    by 0x1100649: reserve (vec.h:1778)
==18930==    by 0x1100649: safe_push (vec.h:1887)
==18930==    by 0x1100649: vectorizable_induction(_loop_vec_info*,
_stmt_vec_info*, gimple**, _slp_tree*, vec<stmt_info_for_cost, va_heap,
vl_ptr>*) (tree-vect-loop.c:8209)
==18930==    by 0x10F7B00: vect_transform_stmt(vec_info*, _stmt_vec_info*,
gimple_stmt_iterator*, _slp_tree*, _slp_instance*) (tree-vect-stmts.c:10901)
==18930==    by 0x11298A6: vect_schedule_slp_node(vec_info*, _slp_tree*,
_slp_instance*) (tree-vect-slp.c:6193)
==18930==    by 0x11364A2: vect_schedule_scc(vec_info*, _slp_tree*,
_slp_instance*, hash_map<_slp_tree*, slp_scc_info,
simple_hashmap_traits<default_hash_traits<_slp_tree*>, slp_scc_info> >&, int&,
vec<_slp_tree*, va_heap, vl_ptr>&) (tree-vect-slp.c:6355)
==18930==    by 0x113621F: vect_schedule_scc(vec_info*, _slp_tree*,
_slp_instance*, hash_map<_slp_tree*, slp_scc_info,
simple_hashmap_traits<default_hash_traits<_slp_tree*>, slp_scc_info> >&, int&,
vec<_slp_tree*, va_heap, vl_ptr>&) (tree-vect-slp.c:6336)
==18930==    by 0x1136ACF: vect_schedule_slp(vec_info*, vec<_slp_instance*,
va_heap, vl_ptr>) (tree-vect-slp.c:6471)
==18930==    by 0x1115717: vect_transform_loop(_loop_vec_info*, gimple*)
(tree-vect-loop.c:9535)
==18930==    by 0x1141FFF: try_vectorize_loop_1(hash_table<simduid_to_vf,
false, xcallocator>*&, unsigned int*, loop*, gimple*, gimple*)
(tree-vectorizer.c:1104)
==18930==    by 0x1142CE0: vectorize_loops() (tree-vectorizer.c:1243)
==18930==    by 0xD99CC7: execute_one_pass(opt_pass*) (passes.c:2567)
==18930==  Block was alloc'd at
==18930==    at 0x483D70F: malloc (vg_replace_malloc.c:380)
==18930==    by 0x1ADDF9F: xrealloc (xmalloc.c:177)
==18930==    by 0x11000DE: reserve<tree_node*> (vec.h:290)
==18930==    by 0x11000DE: reserve (vec.h:1778)
==18930==    by 0x11000DE: safe_push (vec.h:1887)
==18930==    by 0x11000DE: vectorizable_induction(_loop_vec_info*,
_stmt_vec_info*, gimple**, _slp_tree*, vec<stmt_info_for_cost, va_heap,
vl_ptr>*) (tree-vect-loop.c:8154)
==18930==    by 0x10F7B00: vect_transform_stmt(vec_info*, _stmt_vec_info*,
gimple_stmt_iterator*, _slp_tree*, _slp_instance*) (tree-vect-stmts.c:10901)
==18930==    by 0x11298A6: vect_schedule_slp_node(vec_info*, _slp_tree*,
_slp_instance*) (tree-vect-slp.c:6193)
==18930==    by 0x11364A2: vect_schedule_scc(vec_info*, _slp_tree*,
_slp_instance*, hash_map<_slp_tree*, slp_scc_info,
simple_hashmap_traits<default_hash_traits<_slp_tree*>, slp_scc_info> >&, int&,
vec<_slp_tree*, va_heap, vl_ptr>&) (tree-vect-slp.c:6355)
==18930==    by 0x113621F: vect_schedule_scc(vec_info*, _slp_tree*,
_slp_instance*, hash_map<_slp_tree*, slp_scc_info,
simple_hashmap_traits<default_hash_traits<_slp_tree*>, slp_scc_info> >&, int&,
vec<_slp_tree*, va_heap, vl_ptr>&) (tree-vect-slp.c:6336)
==18930==    by 0x1136ACF: vect_schedule_slp(vec_info*, vec<_slp_instance*,
va_heap, vl_ptr>) (tree-vect-slp.c:6471)
==18930==    by 0x1115717: vect_transform_loop(_loop_vec_info*, gimple*)
(tree-vect-loop.c:9535)
==18930==    by 0x1141FFF: try_vectorize_loop_1(hash_table<simduid_to_vf,
false, xcallocator>*&, unsigned int*, loop*, gimple*, gimple*)
(tree-vectorizer.c:1104)
==18930==    by 0x1142CE0: vectorize_loops() (tree-vectorizer.c:1243)
==18930==    by 0xD99CC7: execute_one_pass(opt_pass*) (passes.c:2567)

[Bug tree-optimization/99947] [11 Regression] ICE Segmentation fault "during GIMPLE pass: vect" since r11-4714-g092cdbd919849759

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99947

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Meh.  C++.

  vec_steps.safe_push (vec_steps[0]);

breaks when vec_steps.safe_push re-allocates (vec_steps[0] returns a
reference).

Testing a fix.

[Bug tree-optimization/99947] [11 Regression] ICE Segmentation fault "during GIMPLE pass: vect" since r11-4714-g092cdbd919849759

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99947

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:d11bcbe166c03f722c0e0d41d6e87ac445758fba

commit r11-8025-gd11bcbe166c03f722c0e0d41d6e87ac445758fba
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Apr 7 10:02:07 2021 +0200

    tree-optimization/99947 - avoid v.safe_push (v[0])

    This avoids (again) the C++ pitfall of pushing a reference to
    sth being reallocated.

    2021-04-07  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/99947
            * tree-vect-loop.c (vectorizable_induction): Pre-allocate
            steps vector to avoid pushing elements from the reallocated
            vector.

            * gcc.dg/torture/pr99947.c: New testcase.

[Bug tree-optimization/99947] [11 Regression] ICE Segmentation fault "during GIMPLE pass: vect" since r11-4714-g092cdbd919849759

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99947

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/99947] [11 Regression] ICE Segmentation fault "during GIMPLE pass: vect" since r11-4714-g092cdbd919849759

[haoxintu at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99947

--- Comment #7 from Haoxin Tu <haoxintu at gmail dot com> ---
Thank you all for your quick response and fixing!

Cheers,
Haoxin