[Bug tree-optimization/18291] New: 4.0: ICE in merge_alias_info

[Bug tree-optimization/18291] New: 4.0: ICE in merge_alias_info

[gcc-bugzilla at gcc dot gnu dot org]

g++ 4.0 gives an ICE compiling the source below with -O1:

$ ./cc1plus -quiet -O1 x.cc
x.cc: In function 'void writeDigi()':
x.cc:10: internal compiler error: in merge_alias_info, at tree-ssa-copy.c:217
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.
$

It's crashing at the abort() here:

212       if (new_ptr_info->name_mem_tag == NULL_TREE)
213         memcpy (new_ptr_info, orig_ptr_info, sizeof (*new_ptr_info));
214       else if (orig_ptr_info->name_mem_tag == NULL_TREE)
215         memcpy (orig_ptr_info, new_ptr_info, sizeof (*orig_ptr_info));
216       else if (orig_ptr_info->name_mem_tag != new_ptr_info->name_mem_tag)
217         abort ();

Here are the values that are being compared:

(gdb) p *orig_ptr_info
$5 = {pt_anything = 0, pt_malloc = 0, value_escapes_p = 0,
  is_dereferenced = 1, pt_global_mem = 0, pt_vars = 0x400b18a0,
  name_mem_tag = 0x400baef4}
(gdb) p *new_ptr_info
$6 = {pt_anything = 0, pt_malloc = 0, value_escapes_p = 0,
  is_dereferenced = 1, pt_global_mem = 0, pt_vars = 0x400b1880,
  name_mem_tag = 0x400bae80}
(gdb) call debug_tree( orig_ptr_info->name_mem_tag)
 <var_decl 0x400baef4 NMT.4
    type <integer_type 0x4002a4fc int public SI
        size <integer_cst 0x400223d8 constant invariant 32>
        unit size <integer_cst 0x40022168 constant invariant 4>
        align 32 symtab 0 alias set -1 precision 32 min <integer_cst 0x40022390 -2147483648> max <integer_cst 0x400223a8 2147483647>
        pointer_to_this <pointer_type 0x40038ef4>>
    addressable used ignored SI file x.cc line 10 size <integer_cst 0x400223d8 32> unit size <integer_cst 0x40022168 4>
    align 32 context <function_decl 0x400b8a6c writeDigi>>
(gdb) call debug_tree( new_ptr_info->name_mem_tag)
 <var_decl 0x400bae80 NMT.3
    type <integer_type 0x4002a4fc int public SI
        size <integer_cst 0x400223d8 constant invariant 32>
        unit size <integer_cst 0x40022168 constant invariant 4>
        align 32 symtab 0 alias set -1 precision 32 min <integer_cst 0x40022390 -2147483648> max <integer_cst 0x400223a8 2147483647>
        pointer_to_this <pointer_type 0x40038ef4>>
    addressable used ignored SI file x.cc line 10 size <integer_cst 0x400223d8 32> unit size <integer_cst 0x40022168 4>
    align 32 context <function_decl 0x400b8a6c writeDigi>>

Environment:
System: Linux karma 2.6.8.1 #20 Mon Sep 13 23:48:47 EDT 2004 i686 i686 i386 GNU/Linux
Architecture: i686

	<machine, os, target, libraries (multiple lines)>
host: i686-pc-linux-gnu
build: i686-pc-linux-gnu
target: i686-pc-linux-gnu
configured with: /home/sss/gcc/gcc/configure --prefix=/usr/local/gcc --enable-threads=posix --enable-long-long --enable-languages=c,c++,f95

How-To-Repeat:


Compile with -O1:
-------------------------------------------------

struct C
{
  int size() const  { return 0;}
};

int foo (int);

void writeDigi()
{
  C strErgC;
  int  mcdigi ;
  int* pmcdigi = &mcdigi ;
  int  mcdigi_crosstalk ;
  if ( foo(0) )
    pmcdigi = &mcdigi_crosstalk;

  int mcdigi_elec_noise ;
  if ( strErgC.size() > 0 )
  {
    foo(*pmcdigi );
    pmcdigi = &mcdigi_elec_noise;
  }
  foo(*pmcdigi);
}

-------------------------------------------------
------- Additional Comments From snyder at fnal dot gov  2004-11-03 20:43 -------
Fix:
	<how to correct or work around the problem, if known (multiple lines)>

-- 
           Summary: 4.0: ICE in merge_alias_info
           Product: gcc
           Version: 0.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: snyder at fnal dot gov
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291

[Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-11-03 21:02 -------
Confirmed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pinskia at gcc dot gnu dot
                   |                            |org, dnovillo at gcc dot gnu
                   |                            |dot org
           Severity|normal                      |critical
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
           Keywords|                            |ice-on-valid-code
   Last reconfirmed|0000-00-00 00:00:00         |2004-11-03 21:02:25
               date|                            |
            Summary|4.0: ICE in merge_alias_info|[4.0 Regression]: ICE in
                   |                            |merge_alias_info
   Target Milestone|---                         |4.0.0
            Version|0.0                         |4.0.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291

[Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[dnovillo at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |dnovillo at gcc dot gnu dot
                   |dot org                     |org
             Status|NEW                         |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291

[Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[reichelt at gcc dot gnu dot org]

------- Additional Comments From reichelt at gcc dot gnu dot org  2004-11-06 22:13 -------
Here's a C testcase:

================================
inline int foo() { return 0; }

void bar(int*);

void baz()
{
    int i, j, *p = &i+1;

    if (foo())
    {
        bar(p);
        p = &j;
    }
    bar(p);
}
================================


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |reichelt at gcc dot gnu dot
                   |                            |org
           Keywords|                            |monitored


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291

[Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-11-06 23:24 -------
Here is a C example which is not undefined:
void bar(int*);
int foo1(void);
int baz()
{
    int i, j, *p = &i, k, k1 = 0;
    if (foo1()) p = &j;
    if (k1)
    {
       *p = 0 ;
        p = &k;
    }
    bar(p);
    return *p;
}

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291

[Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-11-06 23:30 -------
One where we only depend on no extern functions:
int baz(int k2)
{
  int i, j, *p, k = 1, k1 = 0;
  if (k2)
    p = &j;
  else
    p = &i;
  if (k1)
    *p = 0 , p = &k;
  *p = 1;
  return k;
}

In fact this should optimize to just return 0;

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291

[Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[dberlin at gcc dot gnu dot org]

------- Additional Comments From dberlin at gcc dot gnu dot org  2004-11-26 22:11 -------
The real bug here is that may_propagate_copy (op, val) returns true, but we
abort when domopts calls propagate_value with the same arguments.

We think something has gone wrong horribly wrong with regards to flow-sensitive
alias info because the block with the &k in it became dead, allowing us to copy
propagate p_1 into p_2.

However, p_2 still has the name tag that includes k (which is now gone
completely), and p_1 doesn't, because alias info hasn't been rebuilt since
CCP+DCE removed the block with &k in it.

There are a couple options, i'll leave it to diego to decide what is best:

1. Make may_propagate_copy return false (conservatively) when we are trying to
propagate and the name tags don't match.  The propagation will still happen
later after alias info gets rebuilt again.
2. Allow the propagation anyway, and just choose the "best" name tag (the one
with the smallest number of pt_vars), under the assumption that we know what the
heck we are doing :)

Diego, if you are too busy, just let me know which you prefer and i'll implement it.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291

[Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[dnovillo at gcc dot gnu dot org]

------- Additional Comments From dnovillo at gcc dot gnu dot org  2004-11-26 22:50 -------
(In reply to comment #6)

> Diego, if you are too busy, just let me know which you prefer and i'll
implement it.
>
I'll take a look, but in principle it seems to me that NMT.1 and NMT.2 should
actually be the same name tag.  They have overlapping points-to sets, after all.
 I'm not sure at the moment what would be the best approach.


Diego.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291

[Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[dnovillo at redhat dot com]

------- Additional Comments From dnovillo at redhat dot com  2004-11-26 22:53 -------
Subject: Re:  [4.0 Regression]: ICE in
	merge_alias_info

On Fri, 2004-11-26 at 22:50 +0000, dnovillo at gcc dot gnu dot org
wrote:
> ------- Additional Comments From dnovillo at gcc dot gnu dot org  2004-11-26 22:50 -------
> (In reply to comment #6)
> 
> > Diego, if you are too busy, just let me know which you prefer and i'll
> implement it.
> >
> I'll take a look, but in principle it seems to me that NMT.1 and NMT.2 should
> actually be the same name tag.  They have overlapping points-to sets, after all.
>  I'm not sure at the moment what would be the best approach.
> 
By which, I mean:

$ cvs diff -dup tree-ssa-alias.c
Index: tree-ssa-alias.c
===================================================================
RCS file: /cvs/gcc/gcc/gcc/tree-ssa-alias.c,v
retrieving revision 2.57
diff -d -u -p -r2.57 tree-ssa-alias.c
--- tree-ssa-alias.c    25 Nov 2004 03:54:07 -0000      2.57
+++ tree-ssa-alias.c    26 Nov 2004 22:52:46 -0000
@@ -771,7 +771,7 @@ create_name_tags (struct alias_info *ai)
              if (qi
                  && qi->pt_vars
                  && qi->name_mem_tag
-                 && bitmap_equal_p (pi->pt_vars, qi->pt_vars))
+                 && bitmap_intersect_p (pi->pt_vars, qi->pt_vars))
                {
                  pi->name_mem_tag = qi->name_mem_tag;
                  break;

But that may be too pessimistic.


Diego.



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291

Re: [Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[Diego Novillo]

On Fri, 2004-11-26 at 22:50 +0000, dnovillo at gcc dot gnu dot org
wrote:
> ------- Additional Comments From dnovillo at gcc dot gnu dot org  2004-11-26 22:50 -------
> (In reply to comment #6)
> 
> > Diego, if you are too busy, just let me know which you prefer and i'll
> implement it.
> >
> I'll take a look, but in principle it seems to me that NMT.1 and NMT.2 should
> actually be the same name tag.  They have overlapping points-to sets, after all.
>  I'm not sure at the moment what would be the best approach.
> 
By which, I mean:

$ cvs diff -dup tree-ssa-alias.c
Index: tree-ssa-alias.c
===================================================================
RCS file: /cvs/gcc/gcc/gcc/tree-ssa-alias.c,v
retrieving revision 2.57
diff -d -u -p -r2.57 tree-ssa-alias.c
--- tree-ssa-alias.c    25 Nov 2004 03:54:07 -0000      2.57
+++ tree-ssa-alias.c    26 Nov 2004 22:52:46 -0000
@@ -771,7 +771,7 @@ create_name_tags (struct alias_info *ai)
              if (qi
                  && qi->pt_vars
                  && qi->name_mem_tag
-                 && bitmap_equal_p (pi->pt_vars, qi->pt_vars))
+                 && bitmap_intersect_p (pi->pt_vars, qi->pt_vars))
                {
                  pi->name_mem_tag = qi->name_mem_tag;
                  break;

But that may be too pessimistic.


Diego.

[Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2004-12-01 18:54 -------
Subject: Bug 18291

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	dnovillo@gcc.gnu.org	2004-12-01 18:54:05

Modified files:
	gcc            : ChangeLog tree-ssa-copy.c 
	gcc/testsuite  : ChangeLog 
Added files:
	gcc/testsuite/gcc.c-torture/compile: pr18291.c 

Log message:
	PR tree-optimization/18291
	* tree-ssa-copy.c (merge_alias_info): Fix merging of
	flow-sensitive alias information.  If the new pointer has no
	name tag, copy it from the original pointer.  Otherwise, make
	sure that the pointed-to sets have a common intersection.
	
	testsuite/ChangeLog
	
	PR tree-optimization/18291
	* testsuite/gcc.c-torture/compile/pr18291.c: New test.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ChangeLog.diff?cvsroot=gcc&r1=2.6663&r2=2.6664
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/tree-ssa-copy.c.diff?cvsroot=gcc&r1=2.20&r2=2.21
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/ChangeLog.diff?cvsroot=gcc&r1=1.4699&r2=1.4700
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/gcc.c-torture/compile/pr18291.c.diff?cvsroot=gcc&r1=NONE&r2=1.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291

[Bug tree-optimization/18291] [4.0 Regression]: ICE in merge_alias_info

[dnovillo at gcc dot gnu dot org]

------- Additional Comments From dnovillo at gcc dot gnu dot org  2004-12-01 19:19 -------

Fix: http://gcc.gnu.org/ml/gcc-patches/2004-12/msg00058.html

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18291