[Bug c/106087] New: Segmentation fault in GIMPLE pass: ccp

[Bug c/106087] New: Segmentation fault in GIMPLE pass: ccp

[nyh at math dot technion.ac.il]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

            Bug ID: 106087
           Summary: Segmentation fault in GIMPLE pass: ccp
           Product: gcc
           Version: 9.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: nyh at math dot technion.ac.il
  Target Milestone: ---

When building the attached file, part of the open-source OSv project, in gcc
12.1.1 (on Fedora 36), I get:


during GIMPLE pass: ccp
bsd/sys/dev/hyperv/vmbus/hyperv.cc: In function ‘bool hyperv_identify()’:
bsd/sys/dev/hyperv/vmbus/hyperv.cc:117:1: internal compiler error: Segmentation
fault
  117 | hyperv_identify()
      | ^~~~~~~~~~~~~~~
Please submit a full bug report, with preprocessed source.
See <http://bugzilla.redhat.com/bugzilla> for instructions.
Preprocessed source stored into /tmp/ccCg8LNL.out file, please attach this to
your bugreport.

The preprocessed source file is attached.

I discovered that removing the two static variables hyperv_pm_features and
hyperv_features3 makes the compilation succeed. These two variables are static,
and are only set by the function which failed compilation and never read
anywhere else in the source file, so these variables are not needed. So I would
have accepted a warning about them being unused - but not a compiler crash.

[Bug c/106087] Segmentation fault in GIMPLE pass: ccp

[nyh at math dot technion.ac.il]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

--- Comment #1 from Nadav Har'El <nyh at math dot technion.ac.il> ---
Created attachment 53199
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53199&action=edit
preprocessed source file which gcc saved for reporting the crash (compressed
because of bugzilla's attachment length limit)

[Bug tree-optimization/106087] Segmentation fault in GIMPLE pass: ccp

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|9.1.1                       |12.1.0
          Component|c                           |tree-optimization

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Hmmm,
See <http://bugzilla.redhat.com/bugzilla> for instructions.

[Bug tree-optimization/106087] Segmentation fault in GIMPLE pass: ccp

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |DUPLICATE

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Dup.

*** This bug has been marked as a duplicate of bug 105956 ***

[Bug tree-optimization/106087] Segmentation fault in GIMPLE pass: ccp

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-07-07
         Resolution|DUPLICATE                   |---
                 CC|                            |pinskia at gcc dot gnu.org,
                   |                            |ppalka at gcc dot gnu.org
             Status|RESOLVED                    |REOPENED
     Ever confirmed|0                           |1

--- Comment #4 from Patrick Palka <ppalka at gcc dot gnu.org> ---
Now that PR105956 is fixed, it looks like we now ICE during fixup_cfg instead
of in the frontend, so reopening.  Looks like the ICE ultimately started with
r12-4598-g113860301f46d1.

[Bug tree-optimization/106087] Segmentation fault in GIMPLE pass: ccp

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

--- Comment #5 from Patrick Palka <ppalka at gcc dot gnu.org> ---
$ g++ -O 106087.ii
during GIMPLE pass: fixup_cfg
bsd/sys/dev/hyperv/vmbus/hyperv.cc: In function ‘bool hyperv_identify()’:
bsd/sys/dev/hyperv/vmbus/hyperv.cc:117:1: internal compiler error: tree check:
expected class ‘type’, have ‘exceptional’ (error_mark) in
useless_type_conversion_p, at gimple-expr.cc:87
0x88cd1b tree_class_check_failed(tree_node const*, tree_code_class, char
const*, int, char const*)
        /home/patrick/gcc/gcc/tree.cc:8867
0x7b836c tree_class_check(tree_node*, tree_code_class, char const*, int, char
const*)
        /home/patrick/gcc/gcc/tree.h:3639
0x7b836c useless_type_conversion_p(tree_node*, tree_node*)
        /home/patrick/gcc/gcc/gimple-expr.cc:87
0x11e74fe verify_gimple_assign_binary
        /home/patrick/gcc/gcc/tree-cfg.cc:4211
0x11f8974 verify_gimple_in_cfg(function*, bool)
        /home/patrick/gcc/gcc/tree-cfg.cc:5504
0x10c7257 execute_function_todo
        /home/patrick/gcc/gcc/passes.cc:2091
0x10c77fb execute_todo
        /home/patrick/gcc/gcc/passes.cc:2145

[Bug c++/106087] Segmentation fault in GIMPLE pass: ccp

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|tree-optimization           |c++

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Patrick Palka from comment #5)
> $ g++ -O 106087.ii
> during GIMPLE pass: fixup_cfg
> bsd/sys/dev/hyperv/vmbus/hyperv.cc: In function ‘bool hyperv_identify()’:
> bsd/sys/dev/hyperv/vmbus/hyperv.cc:117:1: internal compiler error: tree
> check: expected class ‘type’, have ‘exceptional’ (error_mark) in
> useless_type_conversion_p, at gimple-expr.cc:87


No, error_mark should not be here at this point ...

[Bug c++/106087] Segmentation fault in GIMPLE pass: ccp

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

--- Comment #7 from Patrick Palka <ppalka at gcc dot gnu.org> ---
The error_mark_node in question is the TREE_TYPE of an SSA_NAME, which was set
in tree-ssanames.cc:release_ssa_name_fn:

598              if it happens to come along a released SSA name and tries
599              to inspect its type.  */
600           TREE_TYPE (var) = error_mark_node;
601
602           /* And finally queue it so that it will be put on the free list. 
*/
603           vec_safe_push (FREE_SSANAMES_QUEUE (fn), var);
604         }
605     }
606
607     /* If the alignment of the pointer described by PI is known, return
true and

[Bug c++/106087] Segmentation fault in GIMPLE pass: ccp

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

--- Comment #8 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Patrick Palka from comment #7)
> The error_mark_node in question is the TREE_TYPE of an SSA_NAME, which was
> set in tree-ssanames.cc:release_ssa_name_fn:
> 
> 598              if it happens to come along a released SSA name and tries
> 599              to inspect its type.  */
> 600           TREE_TYPE (var) = error_mark_node;
> 601
> 602           /* And finally queue it so that it will be put on the free
> list.  */
> 603           vec_safe_push (FREE_SSANAMES_QUEUE (fn), var);
> 604         }
> 605     }
> 606
> 607     /* If the alignment of the pointer described by PI is known, return
> true and

Let me try to debug this but I suspect it is a latent bug somewhere else.
Because the code just calls simple_dce_from_worklist which would be broken ...

[Bug tree-optimization/106087] [12/13 Regression] ICE with inline-asm with multiple output and assigned only static vars

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Segmentation fault in       |[12/13 Regression] ICE with
                   |GIMPLE pass: ccp            |inline-asm with multiple
                   |                            |output and assigned only
                   |                            |static vars
           Keywords|                            |inline-asm
   Target Milestone|---                         |12.2
             Status|REOPENED                    |NEW

--- Comment #9 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Looks like it is a latent bug in how simple_dce_from_worklist handles
inline-asm.

The statement which is removed which should not be but is:
__asm__("cpuid" : "=a" r$a_18, "=b" r$b_19, "=c" r$c_20, "=d" r$d_21 : "0"
1073741827);

[Bug tree-optimization/106087] [12/13 Regression] ICE with inline-asm with multiple output and assigned only static vars

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-reduction             |

--- Comment #10 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced testcase:
static int t;

int f(void)
{
  int tt, tt1;
  asm("":"=r"(tt), "=r"(tt1));
  t = tt1;
  return tt;
}

[Bug tree-optimization/106087] [12/13 Regression] ICE with inline-asm with multiple output and assigned only static vars

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |pinskia at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #11 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I think I have a fix.

[Bug tree-optimization/106087] [12/13 Regression] ICE with inline-asm with multiple output and assigned only static vars

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

--- Comment #12 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
diff --git a/gcc/tree-ssa-dce.cc b/gcc/tree-ssa-dce.cc
index bc533582673..03d0fcdd8d7 100644
--- a/gcc/tree-ssa-dce.cc
+++ b/gcc/tree-ssa-dce.cc
@@ -2061,6 +2061,10 @@ simple_dce_from_worklist (bitmap worklist)
       if (gimple_has_side_effects (t))
        continue;

+      /* The defining statement needs to be defining one this name. */
+      if (single_ssa_def_operand (t, SSA_OP_DEF) == nullptr)
+       continue;
+
       /* Don't remove statements that are needed for non-call
         eh to work.  */
       if (stmt_unremovable_because_of_non_call_eh_p (cfun, t))

[Bug tree-optimization/106087] [12/13 Regression] ICE with inline-asm with multiple output and assigned only static vars

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

--- Comment #13 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #12)
Note this change is not fully correct as I need to check for PHIs too. as
single_ssa_def_operand does not work on PHI nodes ...
But I have a full patch in testing now.

[Bug tree-optimization/106087] [12/13 Regression] ICE with inline-asm with multiple output and assigned only static vars

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://gcc.gnu.org/piperma
                   |                            |il/gcc-patches/2022-July/59
                   |                            |8050.html
           Keywords|                            |patch

--- Comment #14 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Patch submitted:
https://gcc.gnu.org/pipermail/gcc-patches/2022-July/598050.html

[Bug tree-optimization/106087] [12/13 Regression] ICE with inline-asm with multiple output and assigned only static vars

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

--- Comment #15 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Andrew Pinski <pinskia@gcc.gnu.org>:

https://gcc.gnu.org/g:71e3daa31cfa35ee58e5899cb00767be92227fd2

commit r13-1581-g71e3daa31cfa35ee58e5899cb00767be92227fd2
Author: Andrew Pinski <apinski@marvell.com>
Date:   Thu Jul 7 22:06:19 2022 +0000

    Fix tree-opt/PR106087: ICE with inline-asm with multiple output and
assigned only static vars

    The problem here is that when we mark the ssa name that was referenced in
the now removed
    dead store (to a write only static variable), the inline-asm would also be
removed
    even though it was defining another ssa name. This fixes the problem by
checking
    to make sure that the statement was only defining one ssa name.

    Committed as approved after a bootstrapped and tested on x86_64 with no
regressions.

            PR tree-optimization/106087

    gcc/ChangeLog:

            * tree-ssa-dce.cc (simple_dce_from_worklist): Check
            to make sure the statement is only defining one operand.

    gcc/testsuite/ChangeLog:

            * gcc.c-torture/compile/inline-asm-1.c: New test.

[Bug tree-optimization/106087] [12 Regression] ICE with inline-asm with multiple output and assigned only static vars

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |11.3.0, 13.0
            Summary|[12/13 Regression] ICE with |[12 Regression] ICE with
                   |inline-asm with multiple    |inline-asm with multiple
                   |output and assigned only    |output and assigned only
                   |static vars                 |static vars

--- Comment #16 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Fixed on the trunk, will wait a week or so to backport it.

[Bug tree-optimization/106087] [12 Regression] ICE with inline-asm with multiple output and assigned only static vars

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/106087] [12 Regression] ICE with inline-asm with multiple output and assigned only static vars

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

--- Comment #17 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:e0e388998b797da09a8c018f6f94d1358fd4b8f1

commit r12-8627-ge0e388998b797da09a8c018f6f94d1358fd4b8f1
Author: Andrew Pinski <apinski@marvell.com>
Date:   Thu Jul 7 22:06:19 2022 +0000

    Fix tree-opt/PR106087: ICE with inline-asm with multiple output and
assigned only static vars

    The problem here is that when we mark the ssa name that was referenced in
the now removed
    dead store (to a write only static variable), the inline-asm would also be
removed
    even though it was defining another ssa name. This fixes the problem by
checking
    to make sure that the statement was only defining one ssa name.

    Committed as approved after a bootstrapped and tested on x86_64 with no
regressions.

            PR tree-optimization/106087

    gcc/ChangeLog:

            * tree-ssa-dce.cc (simple_dce_from_worklist): Check
            to make sure the statement is only defining one operand.

    gcc/testsuite/ChangeLog:

            * gcc.c-torture/compile/inline-asm-1.c: New test.

    (cherry picked from commit 71e3daa31cfa35ee58e5899cb00767be92227fd2)

[Bug tree-optimization/106087] [12 Regression] ICE with inline-asm with multiple output and assigned only static vars

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106087

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
      Known to work|                            |12.1.1
             Status|ASSIGNED                    |RESOLVED
      Known to fail|                            |12.1.0

--- Comment #18 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.