https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128187
Bug ID: 128187
Summary: [vect] ICE: Segmentation fault in do_valueize on fma
reduction with masked epilogue, -O3 -ffast-math
-march=znver4
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: tree-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: dohanam2 at illinois dot edu
Target Milestone: ---
The vectorizer crashes with a segmentation fault in value numbering (during
GIMPLE pass: vect) on a loop that accumulates with `__builtin_fma` and also
stores an `int`.
```c
double f(double *a, int *d, int n, double s) {
for (int i = 0; i < n; i++) {
s = __builtin_fma(a[i], a[i], s);
d[i] = 1;
}
return s;
}
```
```
gcc -O3 -ffast-math -march=znver4 -c reduced.c
```
`-O3 -ffast-math -mavx512f --param=vect-partial-vector-usage=2` fails the same
way.
```
reduced.c:1:8: internal compiler error: Segmentation fault
0x1d427b3 do_valueize(tree_node*, tree_node* (*)(tree_node*), bool&)
../../gcc/gimple-match-exports.cc:211
0x1d427b3 gimple_simplify(gimple*, gimple_match_op*, gimple**, tree_node*
(*)(tree_node*), tree_node* (*)(tree_node*))
../../gcc/gimple-match-exports.cc:884
0xe2e782 gimple_fold_stmt_to_constant_1(gimple*, tree_node* (*)(tree_node*),
tree_node* (*)(tree_node*))
../../gcc/gimple-fold.cc:9729
0x1487083 visit_stmt
../../gcc/tree-ssa-sccvn.cc:6750
0x148797f process_bb
../../gcc/tree-ssa-sccvn.cc:8596
```
The file is valid C and should compile; znver4 enables masked epilogues by
default, so no unusual option is involved.
It reproduces at 4dee18cade51d955d9cd6dc86f4399be133a2821 (both commands fail
the same way). The checking build and the release build both crash with the
same "Segmentation fault (during GIMPLE pass: vect)" in do_valueize, exit code
4.
The vect dump shows `.COND_FMA (_107, vect__4.10_61, vect__4.10_61, );`, a call
with a NULL last argument where IFN_COND_FMA takes 5 arguments. This looks like
the `masked_loop_p && !mask_by_cond_expr` branch of
tree-vect-loop.cc:vect_transform_reduction building the call with 4 arguments
and an unset `vop[2]` when `reduc_index == 2`; I have not confirmed this with a
patch.
Found with an LLM-based testing tool; I used Claude to reduce it and look for
the cause.
