[Bug c/30212] New: C Compiler crash on loop optimization

[Bug c/30212] New: C Compiler crash on loop optimization

[suehring at hhi dot de]

The C compiler crashes while compilation of a simple test program with
optimizaion -O2 and above.

The bug seems to be triggered by unrolling a loop which contains a "?" operator
inside an array index.

The crash occured on the gcc versions shipped with SuSE 10.2 (GNU C version
4.1.2 20061115 (prerelease) (SUSE Linux) (i586-suse-linux) ) and Ubuntu 6.10
(gcc (GCC) 4.1.2 20060928 (prerelease) (Ubuntu 4.1.1-13ubuntu5) )

Here is the output from SuSE:

test@suse102:~/projects/gcc-crash> gcc -v -save-temps -O2 -o gcc-crash
gcc-crash.c
Using built-in specs.
Target: i586-suse-linux
Configured with: ../configure --enable-threads=posix --prefix=/usr
--with-local-prefix=/usr/local --infodir=/usr/share/info
--mandir=/usr/share/man --libdir=/usr/lib --libexecdir=/usr/lib
--enable-languages=c,c++,objc,fortran,obj-c++,java,ada
--enable-checking=release --with-gxx-include-dir=/usr/include/c++/4.1.2
--enable-ssp --disable-libssp --disable-libgcj --with-slibdir=/lib
--with-system-zlib --enable-shared --enable-__cxa_atexit
--enable-libstdcxx-allocator=new --program-suffix=-4.1
--enable-version-specific-runtime-libs --without-system-libunwind
--with-cpu=generic --host=i586-suse-linux
Thread model: posix
gcc version 4.1.2 20061115 (prerelease) (SUSE Linux)
 /usr/lib/gcc/i586-suse-linux/4.1.2/cc1 -E -quiet -v gcc-crash.c -mtune=generic
-O2 -fpch-preprocess -o gcc-crash.i
#include "..." search starts here:
#include <...> search starts here:
 /usr/local/include
 /usr/lib/gcc/i586-suse-linux/4.1.2/include
 /usr/lib/gcc/i586-suse-linux/4.1.2/../../../../i586-suse-linux/include
 /usr/include
End of search list.
 /usr/lib/gcc/i586-suse-linux/4.1.2/cc1 -fpreprocessed gcc-crash.i -quiet
-dumpbase gcc-crash.c -mtune=generic -auxbase gcc-crash -O2 -version -o
gcc-crash.s
GNU C version 4.1.2 20061115 (prerelease) (SUSE Linux) (i586-suse-linux)
        compiled by GNU C version 4.1.2 20061115 (prerelease) (SUSE Linux).
GGC heuristics: --param ggc-min-expand=64 --param ggc-min-heapsize=64527
Compiler executable checksum: 56c778b1bb718636fb229d3eaf03526e
gcc-crash.c: In function \u2018test_crash\u2019:
gcc-crash.c:4: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://bugs.opensuse.org> for instructions.


-- 
           Summary: C Compiler crash on loop optimization
           Product: gcc
           Version: 4.1.2
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: suehring at hhi dot de


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug c/30212] C Compiler crash on loop optimization

[suehring at hhi dot de]

------- Comment #1 from suehring at hhi dot de  2006-12-14 14:04 -------
Created an attachment (id=12802)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=12802&action=view)
Test case

Fails to compile with "gcc -O2 -o gcc-crash gcc-crash.c"


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug tree-optimization/30212] [4.1 Regression] C Compiler crash on loop optimization

[rguenth at gcc dot gnu dot org]

------- Comment #2 from rguenth at gcc dot gnu dot org  2006-12-14 14:12 -------
Confirmed.

Starting program: /abuild/rguenther/gcc41-g/gcc/cc1 -quiet -O2 /tmp/bug.c

Program received signal SIGSEGV, Segmentation fault.
0x0000000000830372 in compare_values (val1=0x0, val2=0x2afe6fd01db0)
    at /space//rguenther/src/svn/gcc-4_1-branch/gcc/tree-vrp.c:431
431       gcc_assert (POINTER_TYPE_P (TREE_TYPE (val1))

This is a regression from 4.1.1.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu dot
                   |                            |org
             Status|UNCONFIRMED                 |NEW
          Component|c                           |tree-optimization
     Ever Confirmed|0                           |1
           Keywords|                            |ice-on-valid-code
      Known to fail|                            |4.1.2
      Known to work|                            |4.1.0 4.1.1
   Last reconfirmed|0000-00-00 00:00:00         |2006-12-14 14:12:09
               date|                            |
            Summary|C Compiler crash on loop    |[4.1 Regression] C Compiler
                   |optimization                |crash on loop optimization


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug tree-optimization/30212] [4.1 Regression] C Compiler crash on loop optimization

[rguenth at gcc dot gnu dot org]

------- Comment #3 from rguenth at gcc dot gnu dot org  2006-12-14 14:28 -------
#2  0x0000000000830b2f in value_ranges_intersect_p (vr0=0x7fff642afd40, 
    vr1=0x7fff642afd20)
    at /space//rguenther/src/svn/gcc-4_1-branch/gcc/tree-vrp.c:625
625       return (value_inside_range (vr1->min, vr0) == 1
(gdb) print *vr1
$1 = {type = VR_RANGE, min = 0x2b0646d85d50, max = 0x0, equiv = 0xdf5978}

coming from

static void
adjust_range_with_scev (value_range_t *vr, struct loop *loop, tree stmt,
                        tree var)
{
...
  else if (vr->type == VR_RANGE)
    {
      tree min = vr->min;
      tree max = vr->max;
...
      else
        { 
          /* If INIT is bigger than VR->MIN, set VR->MIN to INIT.  */
          if (compare_values (init, min) == 1)
            {
              min = init;

              /* If we just created an invalid range with the minimum
                 greater than the maximum, take the maximum all the
                 way to +INF.  */
              if (compare_values (min, max) == 1)
                max = TYPE_MAX_VALUE (TREE_TYPE (max));
            }
        }

      set_value_range (vr, VR_RANGE, min, max, vr->equiv);

where we set max to TYPE_MAX_VALUE (TREE_TYPE (max)), but the original
max of range has pointer type bounds which don't have TYPE_MIN/MAX_VALUEs set.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug tree-optimization/30212] [4.1 Regression] C Compiler crash on loop optimization

[rguenth at gcc dot gnu dot org]

------- Comment #4 from rguenth at gcc dot gnu dot org  2006-12-14 14:39 -------
This was fixed on trunk by

Author: rakdver
Date: Thu Aug 17 08:22:05 2006
New Revision: 116213

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=116213
Log:
        PR tree-optimization/27865
        * tree-vrp.c (adjust_range_with_scev): Do not use TYPE_{MIN,MAX}_VALUE
        for pointer types.
        * tree-scalar-evolution.c (fold_used_pointer_cast, pointer_offset_p,
        fold_used_pointer, pointer_used_p): New functions.
        (analyze_scalar_evolution_1): Use fold_used_pointer.
        * tree-chrec.c (convert_affine_scev): Convert no-op casts correctly.
        * tree-ssa-loop-ivopts.c (generic_type_for): Return integral type
        for pointers.

I'll backport the vrp changes.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug tree-optimization/30212] [4.1 Regression] C Compiler crash on loop optimization

[rguenth at gcc dot gnu dot org]

------- Comment #5 from rguenth at gcc dot gnu dot org  2006-12-14 14:51 -------
Mine.  Bootstrap & regtest running.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |rguenth at gcc dot gnu dot
                   |dot org                     |org
             Status|NEW                         |ASSIGNED
   Last reconfirmed|2006-12-14 14:12:09         |2006-12-14 14:51:30
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug tree-optimization/30212] [4.1 Regression] C Compiler crash on loop optimization

[rguenth at gcc dot gnu dot org]

------- Comment #6 from rguenth at gcc dot gnu dot org  2006-12-14 17:02 -------
Created an attachment (id=12803)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=12803&action=view)
patch

This is the backport of the relevant parts.  Seems to introduce some libjava
failures though.

                === libjava tests ===


Running target unix
FAIL: FileHandleGcTest execution - source compiled test
FAIL: FileHandleGcTest execution - gij test
FAIL: FileHandleGcTest -O3 execution - source compiled test
FAIL: PR3096 execution - gij test
FAIL: PR3096 execution - gij test
FAIL: Thread_Monitor execution - gij test
FAIL: Thread_Monitor execution - gij test
FAIL: err4 execution - gij test
FAIL: err4 execution - gij test
FAIL: indirect execution - gij test
FAIL: indirect execution - gij test
FAIL: search_outer execution - gij test
FAIL: search_outer execution - gij test
FAIL: tp execution - gij test
FAIL: tp execution - gij test
FAIL: update_outer output - gij test
FAIL: update_outer output - gij test


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug tree-optimization/30212] [4.1 Regression] C Compiler crash on loop optimization

[pinskia at gcc dot gnu dot org]

-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|major                       |normal
   Target Milestone|---                         |4.1.2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug tree-optimization/30212] [4.1 Regression] C Compiler crash on loop optimization

[rguenth at gcc dot gnu dot org]

------- Comment #7 from rguenth at gcc dot gnu dot org  2006-12-14 17:22 -------
Needs further investigation -> dnovillo (or myself in a few weeks).


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|rguenth at gcc dot gnu dot  |dnovillo at redhat dot com
                   |org                         |
           Severity|normal                      |major
   Target Milestone|4.1.2                       |---


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug tree-optimization/30212] [4.1 Regression] C Compiler crash on loop optimization

[pinskia at gcc dot gnu dot org]

-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|major                       |normal
   Target Milestone|---                         |4.1.2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug tree-optimization/30212] [4.1 Regression] C Compiler crash on loop optimization

[rguenth at gcc dot gnu dot org]

------- Comment #8 from rguenth at gcc dot gnu dot org  2007-01-05 22:47 -------
Subject: Bug 30212

Author: rguenth
Date: Fri Jan  5 22:47:47 2007
New Revision: 120507

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=120507
Log:
2007-01-05  Richard Guenther  <rguenther@suse.de>

        PR tree-optimization/30212
        * tree-vrp.c (adjust_range_with_scev): Do not adjust invalid
        ranges by using TYPE_MIN_VALUE or TYPE_MAX_VALUE.

        * gcc.dg/torture/pr30212.c: New testcase.

Added:
    branches/gcc-4_1-branch/gcc/testsuite/gcc.dg/torture/pr30212.c
Modified:
    branches/gcc-4_1-branch/gcc/ChangeLog
    branches/gcc-4_1-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_1-branch/gcc/tree-vrp.c


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212

[Bug tree-optimization/30212] [4.1 Regression] C Compiler crash on loop optimization

[rguenth at gcc dot gnu dot org]

------- Comment #9 from rguenth at gcc dot gnu dot org  2007-01-05 22:48 -------
Fixed for 4.1.2.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30212