[Bug middle-end/23511] New: Segfault in fold_binary

[Bug middle-end/23511] New: Segfault in fold_binary

[aj at gcc dot gnu dot org]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 5333 bytes --]

Compiling glibc I get a segmentation fault:

/opt/gcc/4.1-devel/libexec/gcc/x86_64-suse-linux-gnu/4.1.0/cc1 -fpreprocessed
strptime_l.i -quiet -dumpbase strptime_l.c -mtune=k8 -auxbase-strip
/builds/glibc/4.1+nptl/time/strptime_l.o -g -O2 -Wall -Winline
-Wstrict-prototypes -Wwrite-strings -std=gnu99 -version -o strptime_l.s
GNU C version 4.1.0 20050821 (experimental) (x86_64-suse-linux-gnu)
        compiled by GNU C version 4.1.0 20050821 (experimental).
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: 5a830930ea2c878ce9ab608e6b40e0e8
strptime_l.i: In function ‘__strptime_internal’:
strptime_l.i:7079: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.


(gdb) r -fpreprocessed strptime_l.i -quiet -dumpbase strptime_l.c -mtune=k8
-auxbase-strip /builds/glibc/4.1+nptl/time/strptime_l.o -g -O2 -Wall -Winline
-Wstrict-prototypes -Wwrite-strings -std=gnu99 -version -o strptime_l.s
GNU C version 4.1.0 20050821 (experimental) (x86_64-suse-linux-gnu)
        compiled by GNU C version 4.1.0 20050821 (experimental).
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: 5a830930ea2c878ce9ab608e6b40e0e8

Program received signal SIGSEGV, Segmentation fault.
fold_binary (code=MINUS_EXPR, type=0x2aaaaadf86e0, op0=0x0, op1=0x2aaaab27ad80)
at /cvs/gcc/gcc/fold-const.c:7127
7127          if (TREE_CODE (arg0) == COMPOUND_EXPR)
(gdb) bt
#0  fold_binary (code=MINUS_EXPR, type=0x2aaaaadf86e0, op0=0x0,
op1=0x2aaaab27ad80) at /cvs/gcc/gcc/fold-const.c:7127
#1  0x000000000060e919 in fold_build2_stat (code=MINUS_EXPR,
type=0x2aaaaadf86e0, op0=0x0, op1=0x2aaaab27ad80)
    at /cvs/gcc/gcc/fold-const.c:10480
#2  0x00000000004d1010 in estimate_numbers_of_iterations_loop (loop=0xf4f7c0) at
/cvs/gcc/gcc/tree-ssa-loop-niter.c:1471
#3  0x00000000004d1588 in scev_probably_wraps_p (type=0x2aaaaadf86e0,
base=<value optimized out>, step=<value optimized out>,
    at_stmt=0x0, loop=0xf4f7c0, init_is_max=0x7fffffffd5e7 "",
unknown_max=0x7fffffffd5e7 "")
    at /cvs/gcc/gcc/tree-ssa-loop-niter.c:1949
#4  0x00000000009d4552 in chrec_convert (type=0x2aaaaadf86e0,
chrec=0x2aaaab33c960, at_stmt=0x0) at /cvs/gcc/gcc/tree-chrec.c:1133
#5  0x00000000009d9fde in instantiate_parameters_1 (loop=0xf4f7c0,
chrec=0x2aaaab2fd180, allow_superloop_chrecs=1 '\001',
    cache=0xf144c0) at /cvs/gcc/gcc/tree-scalar-evolution.c:2080
#6  0x00000000009dab81 in instantiate_parameters (loop=0xf4f7c0,
chrec=0x2aaaab2fd180) at /cvs/gcc/gcc/tree-scalar-evolution.c:2174
#7  0x000000000097e845 in vrp_visit_assignment (stmt=0x2aaaab37f870,
output_p=0x7fffffffd730) at /cvs/gcc/gcc/tree-vrp.c:1544
#8  0x00000000004e4456 in simulate_stmt (stmt=0x2aaaab37f870) at
/cvs/gcc/gcc/tree-ssa-propagate.c:301
#9  0x00000000004e4bb9 in ssa_propagate (visit_stmt=<value optimized out>,
visit_phi=<value optimized out>)
    at /cvs/gcc/gcc/tree-ssa-propagate.c:424
#10 0x00000000009806b4 in execute_vrp () at /cvs/gcc/gcc/tree-vrp.c:3915
#11 0x000000000097077c in execute_one_pass (pass=0xd92860) at
/cvs/gcc/gcc/passes.c:808
#12 0x00000000009708ac in execute_pass_list (pass=0xd92860) at
/cvs/gcc/gcc/passes.c:840
#13 0x00000000009708be in execute_pass_list (pass=0xd8eac0) at
/cvs/gcc/gcc/passes.c:841
#14 0x0000000000483135 in tree_rest_of_compilation (fndecl=0x2aaaab047500) at
/cvs/gcc/gcc/tree-optimize.c:419
#15 0x000000000040bf4d in c_expand_body (fndecl=0x2aaaab047500) at
/cvs/gcc/gcc/c-decl.c:6633
#16 0x00000000009c4a26 in cgraph_expand_function (node=0x2aaaab373160) at
/cvs/gcc/gcc/cgraphunit.c:1037
#17 0x00000000009c6bbb in cgraph_optimize () at /cvs/gcc/gcc/cgraphunit.c:1103
#18 0x0000000000416123 in c_write_global_declarations () at
/cvs/gcc/gcc/c-decl.c:7618
#19 0x00000000009425d6 in toplev_main (argc=<value optimized out>, argv=<value
optimized out>) at /cvs/gcc/gcc/toplev.c:984
#20 0x00002aaaaabde54a in __libc_start_main () from /lib64/tls/libc.so.6
#21 0x000000000040265a in _start () at start.S:113

(gdb) pt type
 <integer_type 0x2aaaaadf86e0 long unsigned int sizes-gimplified asm_written
public unsigned DI
    size <integer_cst 0x2aaaaadeac30 type <integer_type 0x2aaaaadf80b0
bit_size_type> constant invariant 64>
    unit size <integer_cst 0x2aaaaadeac60 type <integer_type 0x2aaaaadf8000 long
unsigned int> constant invariant 8>
    align 64 symtab -1428224608 alias set -1 precision 64 min <integer_cst
0x2aaaaadead50 0> max <integer_cst 0x2aaaaadead20 18446744073709551615>
    pointer_to_this <pointer_type 0x2aaaab059160>>

(gdb) pt op1
 <integer_cst 0x2aaaab27ad80 type <integer_type 0x2aaaab075bb0> constant
invariant 0>

This bug has been introduced during the last 7 days.

-- 
           Summary: Segfault in fold_binary
           Product: gcc
           Version: 4.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: middle-end
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: aj at gcc dot gnu dot org
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: x86_64-linux-gnu
  GCC host triplet: x86_64-linux-gnu
GCC target triplet: x86_64-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23511

[Bug middle-end/23511] Segfault in fold_binary

[aj at gcc dot gnu dot org]

------- Additional Comments From aj at gcc dot gnu dot org  2005-08-22 05:01 -------
Created an attachment (id=9550)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=9550&action=view)
testcase


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23511

[Bug middle-end/23511] [4.1 Regression] Segfault in fold_binary

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
            Summary|Segfault in fold_binary     |[4.1 Regression] Segfault in
                   |                            |fold_binary
   Target Milestone|---                         |4.1.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23511

[Bug middle-end/23511] [4.1 Regression] Segfault in fold_binary

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-08-22 11:06 -------
Reducing.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23511

[Bug middle-end/23511] [4.1 Regression] Segfault in fold_binary

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-08-22 11:50 -------
Confirmed, reduced testcase:
struct locale_data {
  int t;
  union locale_data_value   {
    const char *string;
  }values [];
};       
void f(const char*);
extern const struct locale_data _nl_C_LC_TIME ;
void g(void)
{            
  int cnt; 
  for (cnt = 0;cnt < 12;++cnt)
    f (((&_nl_C_LC_TIME.values[1].string)[cnt]));
}  

Yes the backtrace is slightly different but the problem is that same, basicially the values[] is the issue 
here.  Changing it to values[1] and it works.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |spop at gcc dot gnu dot org
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
  GCC build triplet|x86_64-linux-gnu            |
   GCC host triplet|x86_64-linux-gnu            |
 GCC target triplet|x86_64-linux-gnu            |
   Last reconfirmed|0000-00-00 00:00:00         |2005-08-22 11:50:55
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23511

[Bug tree-optimization/23511] [4.1 Regression] Segfault in fold_binary

[sebastian dot pop at cri dot ensmp dot fr]

------- Additional Comments From sebastian dot pop at cri dot ensmp dot fr  2005-08-22 12:34 -------
The following patch fixes the problem.  However I cannot boot'n'regtest
it for the moment.  I will commit it only tomorow once it is validated.

seb

*** tree-ssa-loop-niter.c.~2.39.~	2005-08-21 12:48:06.000000000 +0200
--- tree-ssa-loop-niter.c	2005-08-22 14:30:17.000000000 +0200
***************
*** 1460,1466 ****
  		    if (init == NULL_TREE
  			|| step == NULL_TREE
  			|| TREE_CODE (init) != INTEGER_CST
! 			|| TREE_CODE (step) != INTEGER_CST)
  		      break;
  
  		    utype = unsigned_type_for (type);
--- 1460,1468 ----
  		    if (init == NULL_TREE
  			|| step == NULL_TREE
  			|| TREE_CODE (init) != INTEGER_CST
! 			|| TREE_CODE (step) != INTEGER_CST
! 			|| TYPE_MIN_VALUE (type) == NULL_TREE
! 			|| TYPE_MAX_VALUE (type) == NULL_TREE)
  		      break;
  
  		    utype = unsigned_type_for (type);

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23511

[Bug tree-optimization/23511] [4.1 Regression] Segfault in fold_binary

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-08-23 08:15 -------
Subject: Bug 23511

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	spop@gcc.gnu.org	2005-08-23 08:15:19

Modified files:
	gcc            : ChangeLog tree-ssa-loop-niter.c 

Log message:
	PR tree-optimization/23511
	* tree-ssa-loop-niter.c (infer_loop_bounds_from_undefined): Don't
	handle cases where TYPE_MIN_VALUE or TYPE_MAX_VALUE are NULL_TREE.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ChangeLog.diff?cvsroot=gcc&r1=2.9804&r2=2.9805
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/tree-ssa-loop-niter.c.diff?cvsroot=gcc&r1=2.39&r2=2.40



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23511

[Bug tree-optimization/23511] [4.1 Regression] Segfault in fold_binary

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-08-23 11:10 -------
Fixed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23511