[Bug c/40759] New: segfault

[Bug c/40759] New: segfault

[regehr at cs dot utah dot edu]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2141 bytes --]

regehr@john-home:~/volatile/tmp173$ current-gcc -c -Wall -O2 small.c
small.c: In function ‘func_150’:
small.c:65:1: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

regehr@john-home:~/volatile/tmp173$ current-gcc -v

Using built-in specs.
Target: i686-pc-linux-gnu
Configured with: ../configure --prefix=/home/regehr/z/tmp/gcc-r149650-install
--program-prefix=r149650- --enable-languages=c,c++
Thread model: posix
gcc version 4.5.0 20090714 (experimental) (GCC) 

regehr@john-home:~/volatile/tmp173$ cat small.c

struct S0 {
  signed char f0;
  signed char f4;
};

struct S0 g_19 = {
  7L, 0L
};

struct S0 g_39 = {
  0L, 0x49L
};

struct S0 g_90 = {
  1L, 0
};

signed char g_125;
signed char g_198;
signed char g_218;

signed char func_17 (int p_18, struct S0 p_20, signed char p_22, signed char
p_24)
{
  return p_20.f0;
}

signed char func_61 (int p_63, signed char p_64, signed char p_65)
{
  return 0;
}

struct S0 func_176 (int p_178, int p_179)
{
  return g_90;
}

struct S0 func_160 (int p_161, int p_163)
{
  struct S0 l_240 = {
    9L, 0L
  };
  if (func_17 (1, func_176 (g_218, 1), 1, 1))
    {
      struct S0 l_253 = {
        0xE0, 0xB4L
      };
      return l_253;
    }
  return l_240;
}

struct S0 func_150 (int p_151, signed char p_153, signed char p_154, signed
char p_155)
{
  signed char l_156 = 0;
  signed char l_266 = 0;
  if (func_17
      (func_61
       (g_125, l_156,
        func_61 (1, func_17 (1, func_160 (l_266, g_90.f4), p_153, 1), 1)),
       func_176 (g_39.f0, 1), 1, 1))
    {
      g_198 = 1;
    }
  return g_19;
}


-- 
           Summary: segfault
           Product: gcc
           Version: 4.5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: regehr at cs dot utah dot edu
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40759

[Bug tree-optimization/40759] [4.5 Regression] segfault in useless_type_conversion_p

[ubizjak at gmail dot com]

-- 

ubizjak at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.5.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40759

[Bug tree-optimization/40759] [4.5 Regression] segfault in useless_type_conversion_p

[ubizjak at gmail dot com]

------- Comment #1 from ubizjak at gmail dot com  2009-07-15 08:19 -------
Confirmed on i686 (x86_64 with -m32):

Program received signal SIGSEGV, Segmentation fault.
useless_type_conversion_p (outer_type=0x2ac18624b240, inner_type=0x0)
    at ../../gcc-svn/trunk/gcc/tree-ssa.c:1003
1003      if (POINTER_TYPE_P (inner_type)

#0  useless_type_conversion_p (outer_type=0x2b34ca46c240, inner_type=0x0)
    at ../../gcc-svn/trunk/gcc/tree-ssa.c:1003
#1  0x000000000078f62c in verify_gimple_phi (stmt=0x2b34ca571900)
    at ../../gcc-svn/trunk/gcc/tree-cfg.c:4095
#2  0x000000000079816e in verify_stmts ()
    at ../../gcc-svn/trunk/gcc/tree-cfg.c:4444
#3  0x000000000088214d in verify_ssa (
    check_modified_stmt=<value optimized out>)
    at ../../gcc-svn/trunk/gcc/tree-ssa.c:545
#4  0x00000000006e57a4 in execute_function_todo (data=<value optimized out>)
    at ../../gcc-svn/trunk/gcc/passes.c:1007


-- 

ubizjak at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
          Component|c                           |tree-optimization
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2009-07-15 08:19:01
               date|                            |
            Summary|segfault                    |[4.5 Regression] segfault in
                   |                            |useless_type_conversion_p


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40759

[Bug tree-optimization/40759] [4.5 Regression] segfault in useless_type_conversion_p

[rguenth at gcc dot gnu dot org]

------- Comment #2 from rguenth at gcc dot gnu dot org  2009-07-15 09:53 -------
Program received signal SIGSEGV, Segmentation fault.
0x086e621a in useless_type_conversion_p (outer_type=0xb7cd43f0, inner_type=0x0)
    at /home/richard/src/trunk/gcc/tree-ssa.c:1003
1003      if (POINTER_TYPE_P (inner_type)
(gdb) up
#1  0x085823cc in verify_gimple_phi (stmt=0xb7d7b380)
    at /home/richard/src/trunk/gcc/tree-cfg.c:4095
4095          if (!useless_type_conversion_p (type, TREE_TYPE (arg)))
(gdb) call debug_gimple_stmt (stmt)
.MEM_20 = PHI <.MEM_33(2), .MEM_24(3)>

(gdb) call debug_tree (arg)
 <ssa_name 0xb7d7eac4 nothrow var <var_decl 0xb7d7c5a0 .MEM>def_stmt 

    version 33 in-free-list>


somebody released that SSA name.  My bet #1 is honzas CD-DCE changes:

#7  0x0848bf5c in execute_one_pass (pass=0x8d09a40)
    at /home/richard/src/trunk/gcc/passes.c:1311
1311      execute_todo (todo_after | pass->todo_flags_finish);
(gdb) p *pass
$1 = {type = GIMPLE_PASS, name = 0x8bb581c "cddce", 
  gate = 0x8646077 <gate_dce>, execute = 0x8646059 <tree_ssa_cd_dce>, 
  sub = 0x0, next = 0x8d0a5a0, static_pass_number = 39, 
  tv_id = TV_TREE_CD_DCE, properties_required = 40, properties_provided = 0, 
  properties_destroyed = 0, todo_flags_start = 524288, todo_flags_finish = 13}


Honza, you likely forget to propagate bare symbols to uses before renaming
somewhere?


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu dot
                   |                            |org
           Keywords|                            |ice-on-valid-code


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40759

[Bug tree-optimization/40759] [4.5 Regression] segfault in useless_type_conversion_p

[rguenth at gcc dot gnu dot org]

-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |hubicka at gcc dot gnu dot
                   |dot org                     |org
             Status|NEW                         |ASSIGNED
           Priority|P3                          |P1


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40759

[Bug tree-optimization/40759] [4.5 Regression] segfault in useless_type_conversion_p

[hubicka at ucw dot cz]

------- Comment #3 from hubicka at ucw dot cz  2009-07-15 11:29 -------
Subject: Re:  [4.5 Regression] segfault in useless_type_conversion_p

I hope that patch for PR40676 should cure those problems.  I am just on
the way to Prague, but I will try to look into it tomorrow.

Honza


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40759

[Bug tree-optimization/40759] [4.5 Regression] segfault in useless_type_conversion_p

[hubicka at ucw dot cz]

------- Comment #4 from hubicka at ucw dot cz  2009-07-23 16:15 -------
Subject: Re:  [4.5 Regression] segfault in useless_type_conversion_p

Hi,
the problem here is in removing virtual PHI.  We replace uses of the
virtual PHI results by the corresponding VAR_DECL and send symbol for
renaming.  However the replacement is done only for live statements and
we send for renaming only if any live statements are found.

The problem here is that virutal PHI defines vop used by dead statement.
The dead statement however define vop used by live statement.  At the
time we are removing the dead statement, live statement gets former PHI
result, now dead in its vuse.

The following patch solves it by simply updating all uses, dead or
alive.  It woudl be possible to keep this check and add check into code
deleting dead_statements to update when result of dead PHI is propagated
through.

I am bootsrapping/regtesting this version.

Index: tree-ssa-dce.c
===================================================================
--- tree-ssa-dce.c      (revision 150009)
+++ tree-ssa-dce.c      (working copy)
@@ -828,9 +828,6 @@ mark_virtual_phi_result_for_renaming (gi
     }
   FOR_EACH_IMM_USE_STMT (stmt, iter, gimple_phi_result (phi))
     {
-      if (gimple_code (stmt) != GIMPLE_PHI
-         && !gimple_plf (stmt, STMT_NECESSARY))
-        continue;
       FOR_EACH_IMM_USE_ON_STMT (use_p, iter)
         SET_USE (use_p, SSA_NAME_VAR (gimple_phi_result (phi)));
       update_stmt (stmt);


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40759

[Bug tree-optimization/40759] [4.5 Regression] segfault in useless_type_conversion_p

[jamborm at gcc dot gnu dot org]

------- Comment #5 from jamborm at gcc dot gnu dot org  2009-07-28 13:28 -------
Honza, unless there are any new problems, can you commit the patch?  Thanks.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40759

[Bug tree-optimization/40759] [4.5 Regression] segfault in useless_type_conversion_p

[hubicka at gcc dot gnu dot org]

------- Comment #6 from hubicka at gcc dot gnu dot org  2009-07-28 16:38 -------
Subject: Bug 40759

Author: hubicka
Date: Tue Jul 28 16:37:50 2009
New Revision: 150168

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=150168
Log:

        PR tree-optimization/40759
        * tree-ssa-dce.c (mark_virtual_phi_result_for_renaming): Mark all uses
        for renaming.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/tree-ssa-dce.c


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40759

[Bug tree-optimization/40759] [4.5 Regression] segfault in useless_type_conversion_p

[rguenth at gcc dot gnu dot org]

------- Comment #7 from rguenth at gcc dot gnu dot org  2009-09-07 10:22 -------
Fixed.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40759