[Bug target/46666] New: gcc.target/i386/funcspec-3.c ICEs in count_reg_usage (cse.c:6596) with -fno-early-inlining

[Bug target/46666] New: gcc.target/i386/funcspec-3.c ICEs in count_reg_usage (cse.c:6596) with -fno-early-inlining

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46666

           Summary: gcc.target/i386/funcspec-3.c ICEs in count_reg_usage
                    (cse.c:6596) with -fno-early-inlining
           Product: gcc
           Version: 4.6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: zsojka@seznam.cz
            Target: x86_64-pc-linux-gnu


Created attachment 22534
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=22534
reduced testcase

Compiler output:
$ gcc -O -fno-early-inlining funcspec-3.i 
==32143== Invalid read of size 4
==32143==    at 0xF80728: count_reg_usage (cse.c:6596)
==32143==    by 0xF80714: count_reg_usage (cse.c:6694)
==32143==    by 0xF80714: count_reg_usage (cse.c:6694)
==32143==    by 0xF807A1: count_reg_usage (cse.c:6638)
==32143==    by 0xF91561: delete_trivially_dead_insns (cse.c:6878)
==32143==    by 0xF427BD: cleanup_cfg (cfgcleanup.c:2329)
==32143==    by 0x5EB27A: into_cfg_layout_mode (cfglayout.c:349)
==32143==    by 0x7EB8AE: execute_one_pass (passes.c:1564)
==32143==    by 0x7EBB74: execute_pass_list (passes.c:1619)
==32143==    by 0x7EBB86: execute_pass_list (passes.c:1620)
==32143==    by 0x92BF05: tree_rest_of_compilation (tree-optimize.c:422)
==32143==    by 0xAF0061: cgraph_expand_function (cgraphunit.c:1508)
==32143==  Address 0x77b5844 is not stack'd, malloc'd or (recently) free'd
==32143== 
==32143== Invalid read of size 2
==32143==    at 0x627127: df_ref_record (df-scan.c:2841)
==32143==    by 0x6286DD: df_entry_block_defs_collect (df-scan.c:3818)
==32143==    by 0x628755: df_record_entry_block_defs (df-scan.c:3835)
==32143==    by 0x62DF3A: df_scan_blocks (df-scan.c:670)
==32143==    by 0x61730A: rest_of_handle_df_initialize (df-core.c:738)
==32143==    by 0x7EB8AE: execute_one_pass (passes.c:1564)
==32143==    by 0x7EBB74: execute_pass_list (passes.c:1619)
==32143==    by 0x7EBB86: execute_pass_list (passes.c:1620)
==32143==    by 0x92BF05: tree_rest_of_compilation (tree-optimize.c:422)
==32143==    by 0xAF0061: cgraph_expand_function (cgraphunit.c:1508)
==32143==    by 0xAF2639: cgraph_optimize (cgraphunit.c:1567)
==32143==    by 0xAF2BA9: cgraph_finalize_compilation_unit (cgraphunit.c:1031)
==32143==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==32143== 
/mnt/svn/gcc-trunk/gcc/testsuite/gcc.target/i386/funcspec-3.c: In function
'main':
/mnt/svn/gcc-trunk/gcc/testsuite/gcc.target/i386/funcspec-3.c:60:1: internal
compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

Reduced attached testcase fails in a different way:
$ gcc -O -fno-early-inlining testcase.c
==27651== Invalid write of size 4
==27651==    at 0xFE82FC: decompose_multiword_subregs (lower-subreg.c:51)
==27651==    by 0xFE9CE8: rest_of_handle_lower_subreg (lower-subreg.c:1346)
==27651==    by 0x7EB8AE: execute_one_pass (passes.c:1564)
==27651==    by 0x7EBB74: execute_pass_list (passes.c:1619)
==27651==    by 0x7EBB86: execute_pass_list (passes.c:1620)
==27651==    by 0x92BF05: tree_rest_of_compilation (tree-optimize.c:422)
==27651==    by 0xAF0061: cgraph_expand_function (cgraphunit.c:1508)
==27651==    by 0xAF2639: cgraph_optimize (cgraphunit.c:1567)
==27651==    by 0xAF2BA9: cgraph_finalize_compilation_unit (cgraphunit.c:1031)
==27651==    by 0x50873B: c_write_global_declarations (c-decl.c:9837)
==27651==    by 0x8D5C6F: toplev_main (toplev.c:819)
==27651==    by 0x6369BBC: (below main) (in /lib64/libc-2.11.2.so)
==27651==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==27651== 
testcase.c: In function 'foo':
testcase.c:11:1: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

[Bug target/46666] gcc.target/i386/funcspec-3.c ICEs in count_reg_usage (cse.c:6596) with -fno-early-inlining

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46666

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2010.11.26 10:27:18
                 CC|                            |nathan at gcc dot gnu.org
     Ever Confirmed|0                           |1

--- Comment #1 from Richard Guenther <rguenth at gcc dot gnu.org> 2010-11-26 10:27:18 UTC ---
Hm.  We do VEC_safe_grow with a size of 0 which doesn't end up allocating
a vector but then unconditionally stores to it.  It explicitly allows for
size == 0, so better play safe.

OTOH there are multiple similar problems in vec.h.  CCing author.

[Bug target/46666] gcc.target/i386/funcspec-3.c ICEs in count_reg_usage (cse.c:6596) with -fno-early-inlining

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46666

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dnovillo at gcc dot gnu.org

--- Comment #2 from Steven Bosscher <steven at gcc dot gnu.org> 2012-10-25 23:11:18 UTC ---
VEC stuff is being rewritten. CC to new author.

Zdenek, can you still reproduce this with a trunk revision?

[Bug target/46666] gcc.target/i386/funcspec-3.c ICEs in count_reg_usage (cse.c:6596) with -fno-early-inlining

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46666

Zdenek Sojka <zsojka at seznam dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.6.4, 4.7.3, 4.8.0
      Known to fail|4.6.0                       |4.4.7, 4.5.4

--- Comment #3 from Zdenek Sojka <zsojka at seznam dot cz> 2012-10-31 19:40:43 UTC ---
(In reply to comment #2)
> VEC stuff is being rewritten. CC to new author.
> 
> Zdenek, can you still reproduce this with a trunk revision?

I can't reproduce it in any of the active branches.