[Bug tree-optimization/19360] New: ICE with -O1 -funit-at-a-time

[Bug tree-optimization/19360] New: ICE with -O1 -funit-at-a-time

[kcwu at csie dot org]

Happen with gcc40 snapshots 4.0.0 20050109 (experimental) and the snapshots in
past months.
gcc configured with --disable-nls --with-system-zlib --program-suffix=40
--disable-shared --prefix=/usr/local x86_64-portbld-freebsd6.0

ICE with -O2,-O3, or -O1 -funit-at-a-time
It works well with -O0 -funit-at-a-time or -O3 -fno-unit-at-a-time
ICE does not happed in gcc 3.4.2

(gdb) r f.c -dumpbase f.c -da -auxbase f -O1 -funit-at-a-time
Starting program: /usr/local/libexec/gcc/x86_64-portbld-freebsd6.0/4.0.0/cc1 f.c
-dumpbase f.c -da -auxbase f -O1 -funit-at-a-time
 g
 f

Analyzing compilation unit
Performing intraprocedural optimizations
Assembling functions:
 f

Program received signal SIGSEGV, Segmentation fault.
0x0000000000453246 in c_types_compatible_p (x=0x0, y=0x80f47a90)
    at .././..//gcc-4.0-20050109/gcc/c-objc-common.c:273
273         return comptypes (TYPE_MAIN_VARIANT (x), TYPE_MAIN_VARIANT (y));
(gdb) l
268     }
269     
270     int
271     c_types_compatible_p (tree x, tree y)
272     {
273         return comptypes (TYPE_MAIN_VARIANT (x), TYPE_MAIN_VARIANT (y));
274     }
(gdb) where                                           
#0  0x0000000000453246 in c_types_compatible_p (x=0x0, y=0x80f47a90)
    at .././..//gcc-4.0-20050109/gcc/c-objc-common.c:273
#1  0x000000000047718e in tree_ssa_useless_type_conversion_1 (
    outer_type=0x80f47a90, inner_type=0x0)            
    at .././..//gcc-4.0-20050109/gcc/tree-ssa.c:739
#2  0x00000000004a2fa1 in may_propagate_copy (dest=0x81058b40, orig=0x810584b0)
    at .././..//gcc-4.0-20050109/gcc/tree-ssa-copy.c:67
#3  0x00000000004bf515 in propagate_to_outgoing_edges (walk_data=Variable
"walk_data" is not available.
)
    at .././..//gcc-4.0-20050109/gcc/tree-ssa-dom.c:2317
#4  0x00000000004c6a87 in walk_dominator_tree (walk_data=0x7fffffffe3d0, 
    bb=0x810541a0) at .././..//gcc-4.0-20050109/gcc/domwalk.c:195
#5  0x00000000004c6abe in walk_dominator_tree (walk_data=0x7fffffffe3d0, 
    bb=0x81054750) at .././..//gcc-4.0-20050109/gcc/domwalk.c:205
#6  0x00000000004c6abe in walk_dominator_tree (walk_data=0x7fffffffe3d0, 
    bb=0x810545b0) at .././..//gcc-4.0-20050109/gcc/domwalk.c:205
#7  0x00000000004c6abe in walk_dominator_tree (walk_data=0x7fffffffe3d0, 
    bb=0x81054270) at .././..//gcc-4.0-20050109/gcc/domwalk.c:205
#8  0x00000000004c6abe in walk_dominator_tree (walk_data=0x7fffffffe3d0, 
    bb=0x8105c000) at .././..//gcc-4.0-20050109/gcc/domwalk.c:205
#9  0x00000000004c6abe in walk_dominator_tree (walk_data=0x7fffffffe3d0, 
    bb=0x810540d0) at .././..//gcc-4.0-20050109/gcc/domwalk.c:205
#10 0x00000000004c6abe in walk_dominator_tree (walk_data=0x7fffffffe3d0, 
    bb=0x81052d00) at .././..//gcc-4.0-20050109/gcc/domwalk.c:205
#11 0x00000000004c01e9 in tree_ssa_dominator_optimize ()
    at .././..//gcc-4.0-20050109/gcc/tree-ssa-dom.c:426
#12 0x000000000047b146 in execute_pass_list (pass=0xb62180)
    at .././..//gcc-4.0-20050109/gcc/tree-optimize.c:526
#13 0x000000000047b1db in execute_pass_list (pass=0xa2e200)
    at .././..//gcc-4.0-20050109/gcc/tree-optimize.c:564
#14 0x000000000047b439 in tree_rest_of_compilation (fndecl=0x8104cea0)
    at .././..//gcc-4.0-20050109/gcc/tree-optimize.c:662
#15 0x0000000000419783 in c_expand_body (fndecl=0x8104cea0)
    at .././..//gcc-4.0-20050109/gcc/c-decl.c:6424

-- 
           Summary: ICE with -O1 -funit-at-a-time
           Product: gcc
           Version: 4.0.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: tree-optimization
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: kcwu at csie dot org
                CC: gcc-bugs at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19360

[Bug tree-optimization/19360] ICE with -O1 -funit-at-a-time

[kcwu at csie dot org]

------- Additional Comments From kcwu at csie dot org  2005-01-10 14:03 -------
Created an attachment (id=7918)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=7918&action=view)
source code exhibiting the ICE


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19360

[Bug tree-optimization/19360] ICE with -O1 -funit-at-a-time

[kcwu at csie dot org]

------- Additional Comments From kcwu at csie dot org  2005-01-10 14:16 -------
(In reply to comment #0)
> ICE with -O2,-O3, or -O1 -funit-at-a-time
> It works well with -O0 -funit-at-a-time or -O3 -fno-unit-at-a-time
sorry, it works well with -O2 -fno-unit-at-a-time, but ICE with -O3
-fno-unit-at-a-time


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19360

[Bug tree-optimization/19360] [4.0 Regression] ICE with -O1 -funit-at-a-time

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-01-10 14:35 -------
Confirmed, here is the reduced testcase:
int bad[100];

int level;
int count;

static inline int g(int *idx)
{
    int m;
    int i;

    do {
	m=0;
	i=*idx;
	switch(i) {
	    case 0:
		i++;
		m=1;
		break;
	}
	*idx=i;
    } while(m<0);
    return m;
}

int f()
{
    int i;

    i=0;
    for(;;) {
	int m;
	m=g(&i);
	if(m==0) break;
	if(level==0 && bad[m])
	    continue;
	count++;
      }
    return 0;
}

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
           Keywords|                            |ice-on-valid-code
   Last reconfirmed|0000-00-00 00:00:00         |2005-01-10 14:35:50
               date|                            |
            Summary|ICE with -O1 -funit-at-a-   |[4.0 Regression] ICE with -
                   |time                        |O1 -funit-at-a-time
   Target Milestone|---                         |4.0.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19360

[Bug tree-optimization/19360] [4.0 Regression] ICE with -O1 -funit-at-a-time

[kcwu at csie dot org]

------- Additional Comments From kcwu at csie dot org  2005-01-10 14:50 -------
(In reply to comment #2)
the complete list:

ICE with:
-O2
-O1 -funit-at-a-time
-O3 -fno-unit-at-a-time
-O1 -finline-functions

works well with:
-O0
-O1
-O2 -fno-unit-at-a-time
-O0 -finline-functions
-O3 -fno-unit-at-a-time -fno-inline-functions

With -O1 -finline-functions, it segfault at the same place(c-objc-common.c:273)

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19360

[Bug tree-optimization/19360] [4.0 Regression] ICE with -O1 -funit-at-a-time

[jakub at gcc dot gnu dot org]

------- Additional Comments From jakub at gcc dot gnu dot org  2005-01-11 11:14 -------
tree-ssa-dom.c in this case uses a released SSA_NAME.
The dom pass recorded a SSA_NAME X into another SSA_NAME (Y)'s SSA_NAME_VALUE,
then tree_duplicate_bb called indirectly from thread_through_all_blocks
marks X for rewrite and following rewrite_ssa_into_ssa releases X, but X's
address is still in Y's SSA_NAME_VALUE.  Later on when Y's SSA_NAME_VALUE is
used, it references a released SSA_NAME and the compiler crashes.


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at redhat dot com,
                   |                            |dnovillo at redhat dot com


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19360

[Bug tree-optimization/19360] [4.0 Regression] ICE with -O1 -funit-at-a-time

[law at redhat dot com]

------- Additional Comments From law at redhat dot com  2005-01-17 20:45 -------
Subject: Re:  [4.0 Regression] ICE with -O1
	-funit-at-a-time

On Tue, 2005-01-11 at 11:14 +0000, jakub at gcc dot gnu dot org wrote:
> ------- Additional Comments From jakub at gcc dot gnu dot org  2005-01-11 11:14 -------
> tree-ssa-dom.c in this case uses a released SSA_NAME.
> The dom pass recorded a SSA_NAME X into another SSA_NAME (Y)'s SSA_NAME_VALUE,
> then tree_duplicate_bb called indirectly from thread_through_all_blocks
> marks X for rewrite and following rewrite_ssa_into_ssa releases X, but X's
> address is still in Y's SSA_NAME_VALUE.  Later on when Y's SSA_NAME_VALUE is
> used, it references a released SSA_NAME and the compiler crashes.
Yea.  I stumbled upon this before I went on vacation last week.  I've 
got a patch here that I'll get bootstrapped and regression tested.

jeff




-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19360

[Bug tree-optimization/19360] [4.0 Regression] ICE with -O1 -funit-at-a-time

[jakub at gcc dot gnu dot org]

------- Additional Comments From jakub at gcc dot gnu dot org  2005-01-18 16:17 -------
Confirmed as fixed.  Thanks.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19360

[Bug tree-optimization/19360] [4.0 Regression] ICE with -O1 -funit-at-a-time

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-02-26 22:27 -------
Subject: Bug 19360

CVSROOT:	/cvs/gcc
Module name:	gcc
Branch: 	apple-ppc-branch
Changes by:	dalej@gcc.gnu.org	2005-02-26 22:27:29

Modified files:
	gcc            : ChangeLog.apple-ppc tree-ssa-dom.c 

Log message:
	2005-02-26  Dale Johanensen  <dalej@apple.com>
	
	Radar 3988125
	PR 19360 (from mainline)
	* tree-ssa-dom.c (tree_ssa_dominator_optimize): Clear SSA_NAME_VALUE
	at the end of the main DOM loop rather than just before DOM exits.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ChangeLog.apple-ppc.diff?cvsroot=gcc&only_with_tag=apple-ppc-branch&r1=1.1.2.325&r2=1.1.2.326
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/tree-ssa-dom.c.diff?cvsroot=gcc&only_with_tag=apple-ppc-branch&r1=1.1.2.149.2.11&r2=1.1.2.149.2.12



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19360