From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 7FA673858405; Tue, 5 Apr 2022 13:49:14 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 7FA673858405 From: "jakub at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug c/105148] [11/12 Regression] ICE in verify_use, at tree-ssa.cc:881 Date: Tue, 05 Apr 2022 13:49:14 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: c X-Bugzilla-Version: 12.0 X-Bugzilla-Keywords: ice-on-valid-code X-Bugzilla-Severity: normal X-Bugzilla-Who: jakub at gcc dot gnu.org X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: 11.3 X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: assigned_to bug_status Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Apr 2022 13:49:14 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D105148 Jakub Jelinek changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|jakub at gcc dot gnu.org |unassigned at gcc d= ot gnu.org Status|ASSIGNED |NEW --- Comment #3 from Jakub Jelinek --- This looks like an ivopts bug and I'm unfortunately not familiar enough with that pass. Before ivopts we have: [local count: 8687547547]: # i_2 =3D PHI # ivtmp_19 =3D PHI saved_stack.2_4 =3D __builtin_stack_save (); foo (); _6 =3D (sizetype) i_2; _7 =3D _6 * 4; y.1_8 =3D __builtin_alloca_with_align (_7, 32); MEM [(int[1][0:D.1996] *)y.1_8][5]{lb: 0 sz: _6 * 4}[i= _2] =3D 0; __builtin_stack_restore (saved_stack.2_4); i_10 =3D i_2 + 1; ivtmp_11 =3D ivtmp_19 - 1; if (ivtmp_11 !=3D 0) goto ; [89.00%] else goto ; [11.00%] [local count: 7731917322]: goto ; [100.00%] loop and ivopts decides to create a new unsigned long ivtmp.9 IV going from 0 with step 1. But it doesn't properly adjust the ARRAY_REF with sz:, so it keeps referencing a freed SSA_NAME _6: [local count: 8687547547]: # ivtmp.9_5 =3D PHI _20 =3D (unsigned int) ivtmp.9_5; i_2 =3D (int) _20; saved_stack.2_4 =3D __builtin_stack_save (); foo (); _3 =3D ivtmp.9_5 * 4; _7 =3D _3; y.1_8 =3D __builtin_alloca_with_align (_7, 32); MEM [(int[1][0:D.1996] *)y.1_8][5]{lb: 0 sz: <<< error >>>}[i_2] =3D 0; __builtin_stack_restore (saved_stack.2_4); ivtmp.9_9 =3D ivtmp.9_5 + 1; if (ivtmp.9_9 !=3D 5) goto ; [89.00%] else goto ; [11.00%] [local count: 7731917322]: goto ; [100.00%] I believe it should use ivtmp.9_5 (printed as ivtmp.9_5 * 4).=