From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id CA93A3858D35; Mon, 29 Apr 2024 16:00:26 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org CA93A3858D35
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1714406426;
	bh=hlsHuaqBCdncDgOicZGJRvjQ6HJ/u+UimKzgNOAjPx8=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=CEKOuSENCbqVxsPIRHEZ+c8iVsiqASX0A7tlIQJj5BunqeW4vDbSX2CrO64w83szQ
	 N5rSD4vrvid0/NIR3yB46ar7U0Xr7+VYHdopakTVVVWERfNQiGSEHuML9DAgWH8pyI
	 iTPwEqMe5ctMsmYjyZ08rGvCAOoBNac6bvXwdjs0=
From: "jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/114872] [13/14/15 Regression] Miscompilation
 with -O2 after commit r13-8037
Date: Mon, 29 Apr 2024 16:00:25 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 13.2.1
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jakub at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 13.3
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-114872-4-jiHWKczXCp@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-114872-4@http.gcc.gnu.org/bugzilla/>
References: <bug-114872-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D114872

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I have looked at the IL and I don't see how it could crash that way based on
the -fdump-tree-optimized-lineno dump, neither on branch nor on the trunk.
On the branch, I see
  <bb 286> [local count: 462566023]:
  [element.c:26539:57 discrim 1] __pyx_t_5_522(ab) =3D 0B;
  [/usr/include/python3.12/object.h:797:8] if (__pyx_t_6_211(ab) !=3D 0B)
    goto <bb 291>; [70.00%]
  else
    goto <bb 290>; [30.00%]

  <bb 290> [local count: 462566023]:
  [element.c:26540:57 discrim 1] __pyx_t_6_524(ab) =3D 0B;
  [/usr/include/python3.12/object.h:797:8] if (__pyx_t_8_1031(ab) !=3D 0B)
    goto <bb 295>; [70.00%]
  else
    goto <bb 294>; [30.00%]

  <bb 291> [local count: 323796219]:
  [/usr/include/python3.12/object.h:242:25] _1105 =3D
[/usr/include/python3.12/object.h:242:25]
[/usr/include/python3.12/object.h:242:25] __pyx_t_6_211(ab)->D.10046.ob_ref=
cnt;
  [/usr/include/python3.12/object.h:242:13] _1106 =3D (int) _1105;
  [/usr/include/python3.12/object.h:700:8 discrim 1] if (_1106 < 0)
    goto <bb 290>; [26.36%]
  else
    goto <bb 292>; [73.64%]

  <bb 292> [local count: 238443538]:
  [/usr/include/python3.12/object.h:704:9] _1107 =3D _1105 + -1;
  [/usr/include/python3.12/object.h:704:8]
[/usr/include/python3.12/object.h:704:13]
[/usr/include/python3.12/object.h:704:13] __pyx_t_6_211(ab)->D.10046.ob_ref=
cnt
=3D _1107;
  [/usr/include/python3.12/object.h:704:8] if (_1107 =3D=3D 0)
    goto <bb 293>; [33.00%]
  else
    goto <bb 290>; [67.00%]

  <bb 293> [local count: 78686364]:
  [/usr/include/python3.12/object.h:705:9] _Py_Dealloc (__pyx_t_6_211(ab));
  goto <bb 290>; [100.00%]

so the 26540 line case checks if the pointer later passed to the _Py_Deallo=
c is
non-NULL and doesn't let it be called in that case.=