[Bug tree-optimization/28935] New: [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[Bug tree-optimization/28935] New: [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[tbm at cyrius dot com]

(gdb) run -ftree-vectorize -O3 orig.c
Starting program: /usr/local/libexec/gcc/x86_64-unknown-linux-gnu/4.2.0/cc1
-ftree-vectorize -O3 orig.c
 vprintf getchar getc_unlocked getchar_unlocked putchar fputc_unlocked
putc_unlocked putchar_unlocked feof_unlocked ferror_unlocked strtod strtol
strtoul strtoq strtouq strtoll strtoull atof atoi atol atoll gnu_dev_major
gnu_dev_minor gnu_dev_makedev __strcspn_c1 __strcspn_c2 __strcspn_c3
__strspn_c1 __strspn_c2 __strspn_c3 __strpbrk_c2 __strpbrk_c3 __strtok_r_1c
__strsep_1c __strsep_2c __strsep_3c tolower toupper default_params
game_fetch_preset free_params dup_params decode_params encode_params
game_configure custom_params validate_params cf_init cf_add cf_clookup
cf_slookup cf_whichsym extend_options genmap gengraph graph_edge_index
graph_vertex_start fourcolour_recurse fourcolour new_scratch free_scratch
bitcount place_colour map_solver new_game_desc parse_edge_list validate_desc
new_game dup_game free_game solve_game game_text_format new_ui free_ui
encode_ui decode_ui game_changed_state region_from_coords interpret_move
execute_move game_compute_size game_set_size game_colours game_new_drawstate
game_free_drawstate draw_error draw_square game_redraw game_anim_length
game_flash_length game_timing_state game_print_size game_print {GC 5409k ->
4262k}
Analyzing compilation unit {GC 5549k -> 5279k}Performing interprocedural
optimizations
Assembling functions:
 validate_params game_text_format encode_ui decode_ui game_changed_state
game_compute_size game_anim_length game_timing_state extend_options {GC 7012k
-> 5709k}
Program received signal SIGSEGV, Segmentation fault.
0x00000000005eb71c in operand_equal_p (arg0=0x2b9e8fa5e930, arg1=<value
optimized out>, flags=0)
    at /home/tbm/scratch/gcc/gcc/fold-const.c:2536
2536            return (! TREE_CONSTANT_OVERFLOW (arg0)
(gdb) where
#0  0x00000000005eb71c in operand_equal_p (arg0=0x2b9e8fa5e930, arg1=<value
optimized out>, flags=0)
    at /home/tbm/scratch/gcc/gcc/fold-const.c:2536
#1  0x000000000060d73a in operand_equal_for_comparison_p (arg0=0x2b9e8fa5e930,
arg1=0x2b9e8fa5e900,
    other=0x2b9e8fa5e930) at /home/tbm/scratch/gcc/gcc/fold-const.c:2763
#2  0x000000000060fbb4 in fold_cond_expr_with_comparison (type=0x2b9e8fa534d0,
arg0=0x2b9e8fefca50,
    arg1=<value optimized out>, arg2=<value optimized out>)
    at /home/tbm/scratch/gcc/gcc/fold-const.c:4544
#3  0x00000000005ef050 in fold_ternary (code=<value optimized out>,
type=0x2b9e8fa534d0,
    op0=<value optimized out>, op1=0x2b9e8fa5e930, op2=0x2b9e8fa5e900)
    at /home/tbm/scratch/gcc/gcc/fold-const.c:11121
#4  0x00000000005efac1 in fold_build3_stat (code=2410015024,
type=0x2b9e8fa5e900, op0=0x0, op1=0x2,
    op2=0x16) at /home/tbm/scratch/gcc/gcc/fold-const.c:11693
#5  0x00000000005ef050 in fold_ternary (code=<value optimized out>,
type=0x2b9e8fa534d0,
    op0=<value optimized out>, op1=0x2b9e8fa5e930, op2=0x2b9e8fa5e900)
    at /home/tbm/scratch/gcc/gcc/fold-const.c:11121
#6  0x00000000005efac1 in fold_build3_stat (code=2410015024,
type=0x2b9e8fa5e900, op0=0x0, op1=0x2,
    op2=0x16) at /home/tbm/scratch/gcc/gcc/fold-const.c:11693
#7  0x00000000005ef050 in fold_ternary (code=<value optimized out>,
type=0x2b9e8fa534d0,
    op0=<value optimized out>, op1=0x2b9e8fa5e930, op2=0x2b9e8fa5e900)
    at /home/tbm/scratch/gcc/gcc/fold-const.c:11121
#8  0x00000000005efac1 in fold_build3_stat (code=2410015024,
type=0x2b9e8fa5e900, op0=0x0, op1=0x2,
    op2=0x16) at /home/tbm/scratch/gcc/gcc/fold-const.c:11693
#9  0x00000000005ef050 in fold_ternary (code=<value optimized out>,
type=0x2b9e8fa534d0,
    op0=<value optimized out>, op1=0x2b9e8fa5e930, op2=0x2b9e8fa5e900)
    at /home/tbm/scratch/gcc/gcc/fold-const.c:11121
#10 0x00000000005efac1 in fold_build3_stat (code=2410015024,
type=0x2b9e8fa5e900, op0=0x0, op1=0x2,
    op2=0x16) at /home/tbm/scratch/gcc/gcc/fold-const.c:11693
#11 0x00000000005ef050 in fold_ternary (code=<value optimized out>,
type=0x2b9e8fa534d0,
    op0=<value optimized out>, op1=0x2b9e8fa5e930, op2=0x2b9e8fa5e900)
    at /home/tbm/scratch/gcc/gcc/fold-const.c:11121
#12 0x00000000005efac1 in fold_build3_stat (code=2410015024,
type=0x2b9e8fa5e900, op0=0x0, op1=0x2,
    op2=0x16) at /home/tbm/scratch/gcc/gcc/fold-const.c:11693
#13 0x00000000005ef050 in fold_ternary (code=<value optimized out>,
type=0x2b9e8fa534d0,
    op0=<value optimized out>, op1=0x2b9e8fa5e930, op2=0x2b9e8fa5e900)
    at /home/tbm/scratch/gcc/gcc/fold-const.c:11121
...


-- 
           Summary: [4.2 regression] Segfault in  operand_equal_p with -
                    ftree-vectorize -O3
           Product: gcc
           Version: 4.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: tbm at cyrius dot com


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28935

[Bug tree-optimization/28935] [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[tbm at cyrius dot com]

------- Comment #1 from tbm at cyrius dot com  2006-09-02 13:45 -------
Created an attachment (id=12176)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=12176&action=view)
preprocessed source


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28935

[Bug tree-optimization/28935] [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[rguenth at gcc dot gnu dot org]

------- Comment #2 from rguenth at gcc dot gnu dot org  2006-09-02 16:15 -------
Reducing.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28935

[Bug tree-optimization/28935] [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[rguenth at gcc dot gnu dot org]

------- Comment #3 from rguenth at gcc dot gnu dot org  2006-09-02 16:35 -------
Confirmed.  Reduced testcase:

int col[8];
int extend_options(int w, int h, int *map, int x, int y, int index)
{
  int dx, dy;
  for (dx = -1; dx <= +1; dx++)
    {
      int index = (dy < 0 ? 6-dx : dy > 0 ? 2+dx : 2*(1+dx));
      if (x+dx >= 0 && x+dx < w && y+dy >= 0 && y+dy < h)
        col[index] = map[(y+dy)*w+(x+dx)];
      col[index] = -1;
    }
}


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu dot
                   |                            |org
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2006-09-02 16:35:13
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28935

[Bug tree-optimization/28935] [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[rguenth at gcc dot gnu dot org]

------- Comment #4 from rguenth at gcc dot gnu dot org  2006-09-02 16:44 -------
We're folding:

#55 0x08184f06 in fold_stmt (stmt_p=0xa7cacbfc) at
/home/richard/src/trunk/gcc/tree-ssa-ccp.c:2408
2408        result = fold (rhs);
(gdb) call debug_generic_expr (*stmt_p)
indexD.1531_315 = 0 != 0 ? 1 : 0
(gdb) down
#54 0x083c0823 in fold (expr=0xa7caf730) at
/home/richard/src/trunk/gcc/fold-const.c:11341
11341             tem = fold_ternary (code, type, op0, op1, op2);
(gdb) call debug_generic_expr (expr)
0 != 0 ? 1 : 0
(gdb) call debug_tree (expr)
 <cond_expr 0xa7caf730
    type <integer_type 0xa7bf9284 int sizes-gimplified public SI
        size <integer_cst 0xa7be73f0 constant invariant 32>
        unit size <integer_cst 0xa7be7180 constant invariant 4>
        align 32 symtab 0 alias set 3 precision 32 min <integer_cst 0xa7be73a8
-2147483648> max <integer_cst 0xa7be73c0 2147483647>
        pointer_to_this <pointer_type 0xa7bf9c38>>

    arg 0 <ne_expr 0xa7cc4774
        type <boolean_type 0xa7bf94ac _Bool public unsigned QI
            size <integer_cst 0xa7be71f8 constant invariant 8>
            unit size <integer_cst 0xa7be7210 constant invariant 1>
            align 8 symtab 0 alias set -1 precision 1 min <integer_cst
0xa7be75e8 0> max <integer_cst 0xa7be7618 1>>

        arg 0 <integer_cst 0xa7be7a20 constant invariant 0> arg 1 <integer_cst
0xa7be7a20 0>>
    arg 1 <integer_cst 0xa7be7a38 type <integer_type 0xa7bf9284 int> constant
invariant 1> arg 2 <integer_cst 0xa7be7a20 0>>

where the problem is (possibly) the unfolded condition.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28935

[Bug tree-optimization/28935] [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[pinskia at gcc dot gnu dot org]

------- Comment #5 from pinskia at gcc dot gnu dot org  2006-09-02 16:52 -------
(In reply to comment #4)
> We're folding:

This is related to PR 23049 which was the same problem but in DOM instead of
CCP.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pinskia at gcc dot gnu dot
                   |                            |org
           Keywords|                            |ice-on-valid-code
   Target Milestone|---                         |4.2.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28935

[Bug tree-optimization/28935] [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[rguenth at gcc dot gnu dot org]

------- Comment #6 from rguenth at gcc dot gnu dot org  2006-09-02 17:11 -------
I have a patch.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |rguenth at gcc dot gnu dot
                   |dot org                     |org
             Status|NEW                         |ASSIGNED
   Last reconfirmed|2006-09-02 16:35:13         |2006-09-02 17:11:33
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28935

[Bug tree-optimization/28935] [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[patchapp at dberlin dot org]

------- Comment #7 from patchapp at dberlin dot org  2006-09-02 21:10 -------
Subject: Bug number PR28935

A patch for this bug has been added to the patch tracker.
The mailing list url for the patch is
http://gcc.gnu.org/ml/gcc-patches/2006-09/msg00061.html


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28935

[Bug tree-optimization/28935] [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[rguenth at gcc dot gnu dot org]

------- Comment #8 from rguenth at gcc dot gnu dot org  2006-09-05 08:34 -------
Subject: Bug 28935

Author: rguenth
Date: Tue Sep  5 08:34:00 2006
New Revision: 116695

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=116695
Log:
2006-09-05  Richard Guenther  <rguenther@suse.de>

        PR middle-end/28935
        * tree-ssa-ccp.c (fold_stmt_r): Make sure to fold the condition
        of a COND_EXPR.

        * gcc.dg/pr28935.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/pr28935.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-ccp.c


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28935

[Bug tree-optimization/28935] [4.2 regression] Segfault in operand_equal_p with -ftree-vectorize -O3

[rguenth at gcc dot gnu dot org]

------- Comment #9 from rguenth at gcc dot gnu dot org  2006-09-05 08:41 -------
Fixed.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28935