Bug 113364 - [14 regression] ICE verify_ssa: `definition in block N does not dominate use in block` with `-O3 -march=znver2`
Summary: [14 regression] ICE verify_ssa: `definition in block N does not dominate use ...
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: middle-end (show other bugs)
Version: 14.0
: P1 normal
Target Milestone: 14.0
Assignee: Tamar Christina
URL:
Keywords: build, ice-on-valid-code
: 113555 113561 (view as bug list)
Depends on:
Blocks:
 
Reported: 2024-01-12 20:54 UTC by Sam James
Modified: 2024-01-24 07:43 UTC (History)
5 users (show)

See Also:
Host:
Target: aarch64-linux-gnu x86_64-linux-gnu
Build:
Known to work:
Known to fail:
Last reconfirmed: 2024-01-23 00:00:00


Attachments
sanitizer_stack_store.ii (31.79 KB, text/plain)
2024-01-13 05:36 UTC, Sam James
Details
Reduced testcase (209 bytes, text/plain)
2024-01-13 06:10 UTC, Andrew Pinski
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James 2024-01-12 20:54:56 UTC
```
libtool: compile:  /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/build/./gcc/xgcc -shared-libgcc -B/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/build/./gcc -nostdinc++ -L/var/tmp/portage/sys-devel/gcc-14
.0.1.9999/work/build/x86_64-pc-linux-gnu/32/libstdc++-v3/src -L/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/build/x86_64-pc-linux-gnu/32/libstdc++-v3/src/.libs -L/var/tmp/portage/sys-devel/gcc-14.0.1.9999/
work/build/x86_64-pc-linux-gnu/32/libstdc++-v3/libsupc++/.libs -B/usr/x86_64-pc-linux-gnu/bin/ -B/usr/x86_64-pc-linux-gnu/lib/ -isystem /usr/x86_64-pc-linux-gnu/include -isystem /usr/x86_64-pc-linux-gnu/sys-i
nclude -m32 -D_GNU_SOURCE -D_DEBUG -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -DHAVE_RPC_XDR_H=0 -DHAVE_TIRPC_RPC_XDR_H=0 -I. -I/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-1
4.0.1.9999/libsanitizer/sanitizer_common -I.. -I /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsanitizer/include -I /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsani
tizer -isystem /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsanitizer/include/system -Wall -W -Wno-unused-parameter -Wwrite-strings -pedantic -Wno-long-long -fPIC -fno-builtin -fno-excep
tions -fno-rtti -fomit-frame-pointer -funwind-tables -fvisibility=hidden -Wno-variadic-macros -I../../libstdc++-v3/include -I../../libstdc++-v3/include/x86_64-pc-linux-gnu -I/var/tmp/portage/sys-devel/gcc-14.
0.1.9999/work/gcc-14.0.1.9999/libsanitizer/../libstdc++-v3/libsupc++ -std=gnu++14 -fcf-protection -mshstk -DSANITIZER_LIBBACKTRACE -DSANITIZER_CP_DEMANGLE -I /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gc
c-14.0.1.9999/libsanitizer/../libbacktrace -I ../libbacktrace -I /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsanitizer/../include -include /var/tmp/portage/sys-devel/gcc-14.0.1.9999/wor
k/gcc-14.0.1.9999/libsanitizer/libbacktrace/backtrace-rename.h -g -O2 -O3 -march=native -mtls-dialect=gnu2 -fno-semantic-interposition -pipe -Wa,-O2 -Wa,-mtune=znver2 -fcf-protection=none -fdiagnostics-color=
always -fdiagnostics-urls=never -ggdb3 -fno-harden-control-flow-redundancy -march=znver2 -O3 -fno-harden-control-flow-redundancy -D_GNU_SOURCE -m32 -c /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.
1.9999/libsanitizer/sanitizer_common/sanitizer_stack_store.cpp  -fPIC -DPIC -o .libs/sanitizer_stack_store.o
/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsanitizer/sanitizer_common/sanitizer_stack_store.cpp:246:6: warning: ISO C++ forbids flexible array member ‘data’ [-Wpedantic]
  246 |   u8 data[];
      |      ^~~~
/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsanitizer/sanitizer_common/sanitizer_stack_store.cpp: In member function ‘__sanitizer::uptr* __sanitizer::StackStore::BlockInfo::GetOrUnpack(
__sanitizer::StackStore*)’:
/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsanitizer/sanitizer_common/sanitizer_stack_store.cpp:253:7: error: definition in block 21 does not dominate use in block 20
  253 | uptr *StackStore::BlockInfo::GetOrUnpack(StackStore *store) {
      |       ^~~~~~~~~~
for SSA_NAME: vect_value_119.379_149 in statement:
vect_value_119.379_143 = PHI <vect_value_119.379_149(20)>
PHI argument
vect_value_119.379_149
for PHI node
vect_value_119.379_143 = PHI <vect_value_119.379_149(20)>
during GIMPLE pass: vect
/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsanitizer/sanitizer_common/sanitizer_stack_store.cpp:253:7: internal compiler error: verify_ssa failed
0x55623ca579c2 verify_ssa(bool, bool) [clone .constprop.0]
        /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/gcc/tree-ssa.cc:1203
0x55623e17bd05 execute_function_todo
        /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/gcc/passes.cc:2095
0x55623e17bd05 do_per_function
        /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/gcc/passes.cc:1687
0x55623e17bd05 execute_todo
        /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/gcc/passes.cc:2142
Please submit a full bug report, with preprocessed source (by using -freport-bug).
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.
make[8]: *** [Makefile:627: sanitizer_stack_store.lo] Error 1
```
Comment 1 Sam James 2024-01-12 20:55:35 UTC
Ugh, I lost the builddir, so give me an hour or so to get it back...
Comment 2 Jakub Jelinek 2024-01-12 22:36:37 UTC
Please provide more details, certainly my x86_64-linux and i686-linux bootstraps went fine.
Comment 3 Andrew Pinski 2024-01-12 22:41:23 UTC
Note the most important part of the command line is `-march=znver2 -O3` .
Comment 4 Sam James 2024-01-13 05:36:42 UTC
Created attachment 57064 [details]
sanitizer_stack_store.ii

Crashes with:
```
# /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/build/./gcc/xgcc -c -shared-libgcc -B/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/build/./gcc -nostdinc++ ./.libs/sanitizer_stack_store.ii -std=gnu++14 -m32 -O3 -march=znver2
/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsanitizer/sanitizer_common/sanitizer_stack_store.cpp: In member function ‘__sanitizer::uptr* __sanitizer::StackStore::BlockInfo::GetOrUnpack(__sanitizer::StackStore*)’:
/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsanitizer/sanitizer_common/sanitizer_stack_store.cpp:253:7: error: definition in block 31 does not dominate use in block 30
  253 | uptr *StackStore::BlockInfo::GetOrUnpack(StackStore *store) {
      |       ^~~~~~~~~~
for SSA_NAME: vect_value_122.379_589 in statement:
vect_value_122.379_590 = PHI <vect_value_122.379_589(30)>
PHI argument
vect_value_122.379_589
for PHI node
vect_value_122.379_590 = PHI <vect_value_122.379_589(30)>
during GIMPLE pass: vect
/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/libsanitizer/sanitizer_common/sanitizer_stack_store.cpp:253:7: internal compiler error: verify_ssa failed
0x5604d3777a76 verify_ssa(bool, bool) [clone .constprop.0]
        /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/gcc/tree-ssa.cc:1203
0x5604d4e9b845 execute_function_todo
        /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/gcc/passes.cc:2095
0x5604d4e9b845 do_per_function
        /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/gcc/passes.cc:1687
0x5604d4e9b845 execute_todo
        /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/gcc/passes.cc:2142
Please submit a full bug report, with preprocessed source (by using -freport-bug).
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.
```

```
# /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/build/./gcc/xgcc -v
Using built-in specs.
COLLECT_GCC=/var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/build/./gcc/xgcc
Target: x86_64-pc-linux-gnu
Configured with: /var/tmp/portage/sys-devel/gcc-14.0.1.9999/work/gcc-14.0.1.9999/configure --host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --prefix=/usr --bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/14 --includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/14/include --datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14 --mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14/man --infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14/info --with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/14/include/g++-v14 --disable-silent-rules --disable-dependency-tracking --with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/14/python --enable-languages=c,c++,fortran --enable-obsolete --enable-secureplt --disable-werror --with-system-zlib --enable-nls --without-included-gettext --disable-libunwind-exceptions --enable-checking=yes,extra,rtl --with-bugurl=https://bugs.gentoo.org/ --with-pkgversion='Gentoo Hardened 14.0.1 p, commit 9d69e54a3b402b0fad067464bd402e92c14504a9' --with-gcc-major-version-only --enable-libstdcxx-time --enable-lto --disable-libstdcxx-pch --enable-shared --enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu --enable-multilib --with-multilib-list=m32,m64 --disable-fixed-point --enable-targets=all --enable-libgomp --disable-libssp --disable-libada --enable-cet --disable-systemtap --enable-valgrind-annotations --disable-vtable-verify --disable-libvtv --with-zstd --with-isl --disable-isl-version-check --enable-default-pie --enable-host-pie --enable-host-bind-now --enable-default-ssp --with-build-config='bootstrap-O3 bootstrap-lto bootstrap-cet'
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.1 20240112 (experimental) 8b447fa89d5e6b052c9309dfd1dafebdbd829ff9 (Gentoo Hardened 14.0.1 p, commit 9d69e54a3b402b0fad067464bd402e92c14504a9)
```
Comment 5 Andrew Pinski 2024-01-13 05:41:37 UTC
Still happens at r14-7220-gac1a399bf61b04 .

Let me try to reduce it.
Comment 6 Andrew Pinski 2024-01-13 06:10:32 UTC
Created attachment 57065 [details]
Reduced testcase

`-O3 -march=znver2 ` is enough with this testcase to reproduce it.
Comment 7 Andrew Pinski 2024-01-13 06:27:30 UTC
Note the testcase also ICEs on aarch64 with just -O3.
Comment 8 Tamar Christina 2024-01-13 08:04:01 UTC
Hmm curious, does it work for you with --with-build-config='bootstrap-O3' that's how I tested it before
Comment 9 Tamar Christina 2024-01-13 09:03:54 UTC
vect_create_epilog_for_reduction needs to handle the case where the vectorizer has picked a different exit than the main one.

diff --git a/gcc/tree-vect-loop.cc b/gcc/tree-vect-loop.cc
index eccf0953bba..6f761a4a78f 100644
--- a/gcc/tree-vect-loop.cc
+++ b/gcc/tree-vect-loop.cc
@@ -5965,7 +5965,8 @@ vect_create_epilog_for_reduction (loop_vec_info loop_vinfo,
      loop-closed PHI of the inner loop which we remember as
      def for the reduction PHI generation.  */
   bool double_reduc = false;
-  bool main_exit_p = LOOP_VINFO_IV_EXIT (loop_vinfo) == loop_exit;
+  bool main_exit_p = LOOP_VINFO_IV_EXIT (loop_vinfo) == loop_exit
+                    && !LOOP_VINFO_EARLY_BREAKS_VECT_PEELED (loop_vinfo);
   stmt_vec_info rdef_info = stmt_info;
   if (STMT_VINFO_DEF_TYPE (stmt_info) == vect_double_reduction_def)
     {

fixes it. But would be good if I can reproduce the bootstrap issue. Will try with provided options.
Comment 10 Sam James 2024-01-13 11:52:22 UTC
(In reply to Tamar Christina from comment #8)
> Hmm curious, does it work for you with --with-build-config='bootstrap-O3'
> that's how I tested it before

Will have a look. I'll try ignore the bootstrap failure and build userland stuff now so we can get some other cases if any.

Did you have -march=<some ISA with good enough vector instructions> too? I imagine bare '-O2' or '-O3' will be ok on amd64.

I built with the above configure args but also:
1. make -j32 -l32 'STAGE1_CFLAGS=-O3 -march=znver2 -pipe' 'BOOT_CFLAGS=-O3 -march=znver2 -pipe' ...
2. CFLAGS=... exported in the env
Comment 11 Jakub Jelinek 2024-01-15 08:55:56 UTC
Like in PR113374, started to ICE with one message in                                                                                                                                  
r14-7194-g6cb155a6cf314232248a12bdd395ed4151ae5a28, another one in                                                                                                                    
r14-7195-g411de96dbf2bdafc7a90ebbfc63e68afd6388d29 and yet another one                                                                                                                
r14-7196-g99c0a540d6689ede068f9ba98af6f38c3cd71362 which is what we get until                                                                                                         
latest trunk.
Comment 12 Richard Biener 2024-01-23 08:28:23 UTC
Re-confirmed after my fixes btw.
Comment 13 Tamar Christina 2024-01-23 08:31:13 UTC
Yes I had to rerun my baseline after updating trunk. Will post patch once peak finishes
Comment 14 Tamar Christina 2024-01-23 08:31:34 UTC
Yes I had to rerun my baseline after updating trunk. Will post patch once peak finishes
Comment 15 Tamar Christina 2024-01-23 14:11:55 UTC
Ok, the fix fixes the ICE but after rebasing to trunk I get a misscompile during bootstrap which miscompiles the x86 backend.

This is likely related to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113539 so tracking it down...
Comment 16 Tamar Christina 2024-01-23 15:48:26 UTC
Ok, I've submitted the patch since the ICE and miscompare are unrelated.

I'll keep this ticket open in any case.  The miscompares didn't happen based on commits from ~2 weeks ago, So this will give me a place to start.

Hopefully send a patch for those tomorrow.
Comment 17 GCC Commits 2024-01-24 07:37:42 UTC
The master branch has been updated by Tamar Christina <tnfchris@gcc.gnu.org>:

https://gcc.gnu.org/g:72429448fd16733f876b282bb37a0653049c446d

commit r14-8382-g72429448fd16733f876b282bb37a0653049c446d
Author: Tamar Christina <tamar.christina@arm.com>
Date:   Wed Jan 24 07:37:17 2024 +0000

    middle-end: fix epilog reductions when vector iters peeled [PR113364]
    
    This fixes a bug where vect_create_epilog_for_reduction does not handle the
    case where all exits are early exits.  In this case we should do like induction
    handling code does and not have a main exit.
    
    This shows that some new miscompiles are happening (stage3 is likely miscompiled)
    but that's unrelated to this patch and I'll look at it next.
    
    gcc/ChangeLog:
    
            PR tree-optimization/113364
            * tree-vect-loop.cc (vect_create_epilog_for_reduction): If all exits all
            early exits then we must reduce from the first offset for all of them.
    
    gcc/testsuite/ChangeLog:
    
            PR tree-optimization/113364
            * gcc.dg/vect/vect-early-break_107-pr113364.c: New test.
Comment 18 Tamar Christina 2024-01-24 07:40:53 UTC
*** Bug 113561 has been marked as a duplicate of this bug. ***
Comment 19 Tamar Christina 2024-01-24 07:42:42 UTC
*** Bug 113555 has been marked as a duplicate of this bug. ***
Comment 20 Tamar Christina 2024-01-24 07:43:59 UTC
I'll continue with the miscompile in PR113539 which I think is a duplicate of PR113467 which I'll verify now.