https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127200
Bug ID: 127200
Summary: [17 Regression] Segmentation fault in SPEC2026
palm/llvm in vectorizer after r17-3793
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Keywords: ice-on-valid-code
Severity: normal
Priority: P3
Component: tree-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: dhruvc at gcc dot gnu.org
CC: rguenth at gcc dot gnu.org
Target Milestone: ---
Target: aarch64
Looks like a follow-on failure from PR127190. Seeing this occurring in
palm/llvm like before.
Min-repro:
===
template <typename IteratorT> struct iterator_range {
IteratorT begin_iterator, end_iterator;
iterator_range(IteratorT, IteratorT) : begin_iterator(0), end_iterator(0) {}
IteratorT begin() { return begin_iterator; }
IteratorT end();
};
template <class T> iterator_range<T> make_range(T x, T y) {
return iterator_range(x, y);
}
struct SmallVectorBase {
void *BeginX;
};
struct ValueIDNum;
template <typename> struct SmallVectorTemplateCommon : SmallVectorBase {
using size_type = long;
using iterator = ValueIDNum *;
using reference = ValueIDNum &;
reference operator[](size_type idx) {
iterator __trans_tmp_4 = (iterator)BeginX;
return __trans_tmp_4[idx];
}
};
struct ilist_iterator {
int operator*();
friend bool operator!=(ilist_iterator, ilist_iterator);
void operator++();
};
struct MachineFunction {
using iterator = ilist_iterator;
iterator begin();
iterator end();
};
template <typename ToIndexT> struct IndexedMap {
using IndexT = ToIndexT::argument_type;
using StorageT = SmallVectorTemplateCommon<int>;
StorageT storage_;
ToIndexT toIndex_;
StorageT::reference operator[](IndexT n) {
unsigned __trans_tmp_3 = toIndex_(n);
return storage_[__trans_tmp_3];
}
};
struct LocIdx {
unsigned Location;
LocIdx(unsigned L) : Location(L) {}
unsigned asU64() { return Location; }
bool operator==(LocIdx L) { return Location == L.Location; }
};
struct ValueIDNum {
struct {
unsigned BlockNo : 20;
long InstNo : 20;
long LocNo : 24;
} u;
ValueIDNum(long Block) { u = {Block, 0, 0}; }
};
struct LocIdxToIndexFunctor {
using argument_type = LocIdx;
unsigned operator()(LocIdx L) { return L.asU64(); }
};
struct MLocTracker {
using LocToValueType = IndexedMap<LocIdxToIndexFunctor>;
unsigned CurBB;
struct MLocIterator {
LocToValueType ValueMap;
LocIdx Idx;
struct value_type {
value_type(ValueIDNum &Value) : Idx(Idx), Value(Value) {}
LocIdx Idx;
ValueIDNum &Value;
};
MLocIterator(LocIdx Idx) : Idx(Idx) {}
bool operator==(MLocIterator Other) { return Idx == Other.Idx; }
void operator++() { Idx = Idx.asU64() + 1; }
value_type operator*() { return ValueMap[Idx]; }
};
void setMPhis() {
for (auto Location : locations())
Location.Value = CurBB;
}
MLocIterator end();
MLocIterator __trans_tmp_5;
iterator_range<MLocIterator> locations() {
MLocIterator __trans_tmp_1 = __trans_tmp_5, __trans_tmp_2 = end();
return make_range(__trans_tmp_1, __trans_tmp_2);
}
};
struct InstrRefBasedLDV {
MLocTracker MTracker;
void produceMLocTransferFunction(MachineFunction &);
};
void InstrRefBasedLDV::produceMLocTransferFunction(MachineFunction &MF) {
for (auto MBB : MF)
MTracker.setMPhis();
}
===
Error message:
===
during GIMPLE pass: vect
<source>: In member function 'void
InstrRefBasedLDV::produceMLocTransferFunction(MachineFunction&)':
<source>:92:6: internal compiler error: Segmentation fault
92 | void InstrRefBasedLDV::produceMLocTransferFunction(MachineFunction &MF)
{
| ^~~~~~~~~~~~~~~~
===
Flags: -O3
Compiler explorer: https://godbolt.org/z/x15nsG9nv
===
LLM-generated explanation:
The failing pass is vect itself - the crash is in its post-pass loop-closed-SSA
verification:
during GIMPLE pass: vect
internal compiler error: Segmentation fault
0x... flow_bb_inside_loop_p(loop const*, basic_block_def const*)
gcc/cfgloop.cc:843
0x... check_loop_closed_ssa_def
gcc/tree-ssa-loop-manip.cc:664
0x... check_loop_closed_ssa_bb
gcc/tree-ssa-loop-manip.cc:689
0x... verify_loop_closed_ssa(bool, loop*)
gcc/tree-ssa-loop-manip.cc:714
Crucially, on the reduced testcase this reproduces with -march=armv8-a - no
SVE. There is no variable-length vector type involved, so the
(TYPE_VECTOR_SUBPARTS (vectype) * *nvectors - vf).is_constant (&rem) failure
behind PR127190 cannot be what is happening here. Adding +sve actually
suppresses it.
So the commit does not only assert on VLA vector types: on fixed-length
Advanced SIMD its excess-lane computation also yields wrong-code, leaving
loop-closed SSA malformed so that verification walks a null block. This is a
wrong-IR bug and needs its own PR, separate from PR127190.
