[Bug tree-optimization/21734] New: ICE: -ftree-vectorize, segfault

[Bug tree-optimization/21734] New: ICE: -ftree-vectorize, segfault

[stefaandr at hotmail dot com]

Segfault on compilation of following source:

struct _matrix {
  double lineardata[4 * 4];
  double & operator()(int row, int col = 0) {
    return lineardata[col * 4 + row];
  }
};

struct matrix : public _matrix {
  typedef _matrix parent;
  double & operator()(int row, int col = 0)
    { return parent::operator()(row,col); }
};

void add(matrix & __restrict in1, matrix & __restrict in2, matrix & __restrict
result) {
  for (int col=0; col<4; ++col)
    for (int row=0; row<4; ++row)
      result(row, col) = in1(row, col) + in2(row, col);
}

--- end of source ---


Using built-in specs.
Target: i686-pc-linux-gnu
Configured with: /esat/alexandria1/sderoeck/src/gcc/main/configure
--prefix=/esat/olympia/install --program-suffix=-cvs --enable-languages=c,c++
Thread model: posix
gcc version 4.1.0 20050523 (experimental)
 /esat/olympia/install/libexec/gcc/i686-pc-linux-gnu/4.1.0/cc1plus -quiet -v
-I/users/visics/sderoeck/projects/clean/CaveIn/Whistler -D_GNU_SOURCE test13.cpp
-quiet -dumpbasetest13.cpp -march=pentium4 -auxbase-strip test13.S -O9 -version
-fverbose-asm -fdump-tree-vect-stats -fdump-tree-vect-details -funroll-all-loops
-ftree-vectorize -o test13.S
ignoring nonexistent directory "/usr/local/include"
ignoring nonexistent directory
"/esat/olympia/install/lib/gcc/i686-pc-linux-gnu/4.1.0/../../../../i686-pc-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /users/visics/sderoeck/projects/clean/CaveIn/Whistler
 /esat/olympia/install/lib/gcc/i686-pc-linux-gnu/4.1.0/../../../../include/c++/4.1.0
 /esat/olympia/install/lib/gcc/i686-pc-linux-gnu/4.1.0/../../../../include/c++/4.1.0/i686-pc-linux-gnu
 /esat/olympia/install/lib/gcc/i686-pc-linux-gnu/4.1.0/../../../../include/c++/4.1.0/backward
 /esat/olympia/install/include
 /esat/olympia/install/lib/gcc/i686-pc-linux-gnu/4.1.0/include
 /usr/include
End of search list.
GNU C++ version 4.1.0 20050523 (experimental) (i686-pc-linux-gnu)
        compiled by GNU C version 4.1.0 20050523 (experimental).
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: 99f1919b6616caa4cacd62f3245b1e14
test13.cpp: In function 'void add(matrix&, matrix&, matrix&)':
test13.cpp:14: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.

-- 
           Summary: ICE: -ftree-vectorize, segfault
           Product: gcc
           Version: 4.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: tree-optimization
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: stefaandr at hotmail dot com
                CC: gcc-bugs at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[reichelt at gcc dot gnu dot org]

------- Additional Comments From reichelt at gcc dot gnu dot org  2005-05-24 14:07 -------
Confirmed.

Reduced testcase (-O2 -ftree-vectorize -march=pentium4):

=========================================================
struct A
{
  int a[4];
  int& operator[](int i) { return a[i]; }
};

struct B : public A
{
  int& operator[](int i) { return A::operator[](i); }
};

void foo(B &b)
{
  for (int i=0; i<4; ++i)
    b[i] = 0;
}
=========================================================


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |reichelt at gcc dot gnu dot
                   |                            |org
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
           Keywords|                            |ice-on-valid-code, monitored
      Known to fail|                            |4.1.0
      Known to work|                            |4.0.0
   Last reconfirmed|0000-00-00 00:00:00         |2005-05-24 14:07:09
               date|                            |
            Summary|ICE: -ftree-vectorize,      |[4.1 regression] ICE: -
                   |segfault                    |ftree-vectorize, segfault
   Target Milestone|---                         |4.1.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-05-24 14:21 -------
Here is a C testcase:
struct a
{
  int aa[4];
};
struct b
{
  struct a aa;
};

void foo(struct b *bb)
{
  int i;
  for (i=0; i<4; ++i)
    {
      struct a *aa = &bb->aa;
      struct a *aa1 = aa;
      struct a *aa2 = aa1;
      int *d = &aa2->aa[i];
      *d = 0;
    }
}

I think this is caused by the forwprop changes.  (Notice the extra variables to reproduce this bug).

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[law at redhat dot com]

------- Additional Comments From law at redhat dot com  2005-05-25 05:55 -------
Subject: Re:  [4.1 regression] ICE:
	-ftree-vectorize, segfault

On Tue, 2005-05-24 at 14:21 +0000, pinskia at gcc dot gnu dot org wrote:
> ------- Additional Comments From pinskia at gcc dot gnu dot org  2005-05-24 14:21 -------
> Here is a C testcase:
> struct a
> {
>   int aa[4];
> };
> struct b
> {
>   struct a aa;
> };
> 
> void foo(struct b *bb)
> {
>   int i;
>   for (i=0; i<4; ++i)
>     {
>       struct a *aa = &bb->aa;
>       struct a *aa1 = aa;
>       struct a *aa2 = aa1;
>       int *d = &aa2->aa[i];
>       *d = 0;
>     }
> }
> 
> I think this is caused by the forwprop changes.  (Notice the extra variables to reproduce this bug).
Actually, this is a bug in the vectorizer code to update PHIs in duplicate
loops.  forwprop AFAICT is just exposing the latent vectorizer bug.

>From what I've been able to determine so far, the vectorizer code to
update PHIs doesn't properly handle the case where a PHI is dead.  It
is likely someone with more experience in the vectorizer code is going
to need to fix this.


Jeff



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[dorit at il dot ibm dot com]

------- Additional Comments From dorit at il dot ibm dot com  2005-05-25 07:28 -------
> Actually, this is a bug in the vectorizer code to update PHIs in duplicate
> loops.  forwprop AFAICT is just exposing the latent vectorizer bug.
> >From what I've been able to determine so far, the vectorizer code to
> update PHIs doesn't properly handle the case where a PHI is dead.  It
> is likely someone with more experience in the vectorizer code is going
> to need to fix this.

I'll take a look



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[giovannibajo at libero dot it]

------- Additional Comments From giovannibajo at libero dot it  2005-05-25 18:43 -------
Assigning to Dorit.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |dorit at il dot ibm dot com
                   |dot org                     |
             Status|NEW                         |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[law at redhat dot com]

------- Additional Comments From law at redhat dot com  2005-05-25 21:43 -------
Subject: Re:  [4.1 regression] ICE:
	-ftree-vectorize, segfault

On Wed, 2005-05-25 at 07:28 +0000, dorit at il dot ibm dot com wrote:
> ------- Additional Comments From dorit at il dot ibm dot com  2005-05-25 07:28 -------
> > Actually, this is a bug in the vectorizer code to update PHIs in duplicate
> > loops.  forwprop AFAICT is just exposing the latent vectorizer bug.
> > >From what I've been able to determine so far, the vectorizer code to
> > update PHIs doesn't properly handle the case where a PHI is dead.  It
> > is likely someone with more experience in the vectorizer code is going
> > to need to fix this.
> 
> I'll take a look
Thanks.  I suspect we have multiple problems with the PHI updates.

I think I know how to fix the code for updating PHIs in the duplicate
loop, but I haven't really slogged through the guard code to figure
out how PHIs in the guards should be updated.


In the case of the duplicate loop we have the following code:


> 
>   /* Scan the phis in the headers of the old and new loops
     (they are organized in exactly the same order).  */

  for (phi_new = phi_nodes (new_loop->header),
       phi_orig = phi_nodes (orig_loop->header);
       phi_new && phi_orig;
       phi_new = PHI_CHAIN (phi_new), phi_orig = PHI_CHAIN (phi_orig))
    {
      /* step 1.  */
      def = PHI_ARG_DEF_FROM_EDGE (phi_orig, entry_arg_e);
      add_phi_arg (phi_new, def, new_loop_entry_e);

      /* step 2.  */
      def = PHI_ARG_DEF_FROM_EDGE (phi_orig, orig_loop_latch);
      if (TREE_CODE (def) != SSA_NAME)
        continue;

      new_ssa_name = get_current_def (def);
      if (!new_ssa_name)
        /* Something defined outside of the loop.  */
        continue;

      /* An ordinary ssa name defined in the loop.  */
      add_phi_arg (phi_new, new_ssa_name, loop_latch_edge (new_loop));

      /* step 3 (case 1).  */
      if (!after)
        {
          gcc_assert (new_loop_exit_e == orig_entry_e);
          SET_PHI_ARG_DEF (phi_orig,
                           new_loop_exit_e->dest_idx,
                           new_ssa_name);
        }


Note that if !new_ssa_name, we continue the loop without ever
adding the PHI argument.  The net result being that we have a
PHI where PHI_ARG_DEF for one of the PHI's incoming edges is null.

I'm pretty sure that this can only happen if the result of the
PHI is not set anywhere in the loop.  In that case the PHI
argument in question should be the same SSA_NAME as the PHI_RESULT
[ ie, we ultimately end up generating a degenerate phi of the form


  x_3 = PHI (x_3 (latch edge), x_2 (initial value from entry edge))



What I don't know yet is if the problem is really that we haven't
set up the current def properly (thus causing get_current_def to
return NULL) or if we just need code to compensate for this
situation in slpeel_update_phis_for_duplicate_loop.

Thoughts?

Jeff





-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[dorit at il dot ibm dot com]

------- Additional Comments From dorit at il dot ibm dot com  2005-05-30 14:35 -------
I can't reproduce this ICE with mainline snapshot from today. (I was able to 
reproduce it a few days ago, but not anymore).

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[stefaandr at hotmail dot com]

------- Additional Comments From stefaandr at hotmail dot com  2005-05-30 19:21 -------
confirmed, I cannot reproduce with the given testcase either.  But my original
source code still triggers a (possibly the same) bug.  I've extracted a new
testcase:

struct M {
  double data[16];
  double* operator[](int row){ return &data[row*4]; };
  void set() {
    for (int i=0;i<16;++i)
      data[i]=0.0;
  }
};

struct A {
  M m1;
  void test();
};

void A::test() {
  M m2;
  m2[2][2]=0.;
  m1.set();
}


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[stefaandr at hotmail dot com]

------- Additional Comments From stefaandr at hotmail dot com  2005-05-31 10:13 -------
For the sake of completeness. the error produced with the new testcase:

Using built-in specs.
Target: i686-pc-linux-gnu
Configured with: /esat/alexandria1/sderoeck/src/gcc/main/configure
--prefix=/esat/olympia/install --program-suffix=-cvs --enable-languages=c,c++
Thread model: posix
gcc version 4.1.0 20050530 (experimental)
 /esat/olympia/install/libexec/gcc/i686-pc-linux-gnu/4.1.0/cc1plus -quiet -v
-D_GNU_SOURCE sweepobject.cpp -quiet -dumpbase sweepobject.cpp -march=pentium4
-auxbase-strip sweepx.o -O2 -version -ftree-vectorize -o /tmp/ccKIKNVA.s
ignoring nonexistent directory "/usr/local/include"
ignoring nonexistent directory
"/esat/olympia/install/lib/gcc/i686-pc-linux-gnu/4.1.0/../../../../i686-pc-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /esat/olympia/install/lib/gcc/i686-pc-linux-gnu/4.1.0/../../../../include/c++/4.1.0
 /esat/olympia/install/lib/gcc/i686-pc-linux-gnu/4.1.0/../../../../include/c++/4.1.0/i686-pc-linux-gnu
 /esat/olympia/install/lib/gcc/i686-pc-linux-gnu/4.1.0/../../../../include/c++/4.1.0/backward
 /esat/olympia/install/include
 /esat/olympia/install/lib/gcc/i686-pc-linux-gnu/4.1.0/include
 /usr/include
End of search list.
GNU C++ version 4.1.0 20050530 (experimental) (i686-pc-linux-gnu)
        compiled by GNU C version 4.1.0 20050530 (experimental).
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: a2126b7dadcd5b4079972b9e8125263a
sweepobject.cpp: In member function 'void A::test()':
sweepobject.cpp:15: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-05-31 23:28 -------
*** Bug 21851 has been marked as a duplicate of this bug. ***

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bangerth at dealii dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734

[Bug tree-optimization/21734] [4.1 regression] ICE: -ftree-vectorize, segfault

[reichelt at gcc dot gnu dot org]

------- Additional Comments From reichelt at gcc dot gnu dot org  2005-06-01 08:41 -------
Even shorter testcase:

============================================
struct A
{
  int a[4];
  int* operator[](int i) { return &a[i]; }
};

void foo(A a1, A &a2)
{
  a1[1][1]=0;
  for (int i=0; i<4; ++i)
    a2.a[i]=0;
}
============================================


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21734