[Bug tree-optimization/47443] New: [4.6 Regression] ICE: SSA name in freelist but still referenced or SIGSEGV with -fstack-check=generic

[Bug tree-optimization/47443] New: [4.6 Regression] ICE: SSA name in freelist but still referenced or SIGSEGV with -fstack-check=generic

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47443

           Summary: [4.6 Regression] ICE: SSA name in freelist but still
                    referenced or SIGSEGV with -fstack-check=generic
           Product: gcc
           Version: 4.6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: zsojka@seznam.cz
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu


Created attachment 23102
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=23102
reduced testcase

I don't know how much is this related to PR47265


Compiler output:
$ gcc -O -fstack-check=generic testcase.c 
testcase.c: In function 'foo':
testcase.c:10:1: error: SSA name in freelist but still referenced
D.2689_3
testcase.c:3:3: note: in statement
D.2701_11 = D.2689_3 < D.2702_10;

testcase.c:10:1: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.


Backtrace for the error:
(gdb) bt
#0  error (gmsgid=0x1143688 "SSA name in freelist but still referenced") at
/mnt/svn/gcc-trunk/gcc/diagnostic.c:747
#1  0x00000000008e37e2 in verify_expr (tp=0x7ffff5d4b888,
walk_subtrees=0x7fffffffd64c, data=<value optimized out>)
    at /mnt/svn/gcc-trunk/gcc/tree-cfg.c:2599
#2  0x0000000000a651df in walk_tree_1 (tp=0x7ffff5d4b888, func=0x8e31c0
<verify_expr>, data=0x7fffffffd750, pset=0x0, lh=0)
    at /mnt/svn/gcc-trunk/gcc/tree.c:10242
#3  0x000000000073f6ac in walk_gimple_op (stmt=0x7ffff5d4b840,
callback_op=0x8e31c0 <verify_expr>, wi=0x7fffffffd750)
    at /mnt/svn/gcc-trunk/gcc/gimple.c:1362
#4  0x00000000008eddf3 in verify_stmt () at
/mnt/svn/gcc-trunk/gcc/tree-cfg.c:4156
#5  verify_stmts () at /mnt/svn/gcc-trunk/gcc/tree-cfg.c:4382
#6  0x0000000000a02a7d in verify_ssa (check_modified_stmt=1 '\001') at
/mnt/svn/gcc-trunk/gcc/tree-ssa.c:878
#7  0x00000000007eeef9 in execute_function_todo (data=<value optimized out>) at
/mnt/svn/gcc-trunk/gcc/passes.c:1246
#8  0x00000000007ef5ed in execute_todo (flags=34823) at
/mnt/svn/gcc-trunk/gcc/passes.c:1277
#9  0x00000000007f1bdf in execute_one_pass (pass=0x160d000) at
/mnt/svn/gcc-trunk/gcc/passes.c:1585
#10 0x00000000007f1ea5 in execute_pass_list (pass=0x160d000) at
/mnt/svn/gcc-trunk/gcc/passes.c:1617
#11 0x00000000007f1eb7 in execute_pass_list (pass=0x160c940) at
/mnt/svn/gcc-trunk/gcc/passes.c:1618
#12 0x00000000007f10ac in do_per_function_toporder (callback=0x7f1e90
<execute_pass_list>, data=0x160c880)
    at /mnt/svn/gcc-trunk/gcc/passes.c:1148
#13 0x00000000007f2346 in execute_ipa_pass_list (pass=0x160c9a0) at
/mnt/svn/gcc-trunk/gcc/passes.c:1934
#14 0x0000000000afd391 in ipa_passes () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1725
#15 cgraph_optimize () at /mnt/svn/gcc-trunk/gcc/cgraphunit.c:1797
#16 0x0000000000afd5ea in cgraph_finalize_compilation_unit () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1042
#17 0x000000000050585c in c_write_global_declarations () at
/mnt/svn/gcc-trunk/gcc/c-decl.c:9843
#18 0x00000000008dd544 in compile_file (argc=14, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:591
#19 do_compile (argc=14, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:1874
#20 toplev_main (argc=14, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:1937
#21 0x00007ffff65f1bbd in __libc_start_main () from /lib/libc.so.6
#22 0x00000000004ec455 in _start ()





Backtrace for the segfault:
Program received signal SIGSEGV, Segmentation fault.
0x000000000073efec in is_gimple_reg_type (t=0x7ffff5d4b478) at
/mnt/svn/gcc-trunk/gcc/gimple.c:2841
2841      return !AGGREGATE_TYPE_P (type);
(gdb) bt
#0  0x000000000073efec in is_gimple_reg_type (t=0x7ffff5d4b478) at
/mnt/svn/gcc-trunk/gcc/gimple.c:2841
#1  is_gimple_val (t=0x7ffff5d4b478) at /mnt/svn/gcc-trunk/gcc/gimple.c:2909
#2  0x00000000008e577f in verify_gimple_assign_binary (stmt=<value optimized
out>) at /mnt/svn/gcc-trunk/gcc/tree-cfg.c:3361
#3  verify_gimple_assign (stmt=<value optimized out>) at
/mnt/svn/gcc-trunk/gcc/tree-cfg.c:3829
#4  verify_types_in_gimple_stmt (stmt=<value optimized out>) at
/mnt/svn/gcc-trunk/gcc/tree-cfg.c:3983
#5  0x00000000008ede2f in verify_stmts () at
/mnt/svn/gcc-trunk/gcc/tree-cfg.c:4385
#6  0x0000000000a02a7d in verify_ssa (check_modified_stmt=1 '\001') at
/mnt/svn/gcc-trunk/gcc/tree-ssa.c:878
#7  0x00000000007eeef9 in execute_function_todo (data=<value optimized out>) at
/mnt/svn/gcc-trunk/gcc/passes.c:1246
#8  0x00000000007ef5ed in execute_todo (flags=34823) at
/mnt/svn/gcc-trunk/gcc/passes.c:1277
#9  0x00000000007f1bdf in execute_one_pass (pass=0x160d000) at
/mnt/svn/gcc-trunk/gcc/passes.c:1585
#10 0x00000000007f1ea5 in execute_pass_list (pass=0x160d000) at
/mnt/svn/gcc-trunk/gcc/passes.c:1617
#11 0x00000000007f1eb7 in execute_pass_list (pass=0x160c940) at
/mnt/svn/gcc-trunk/gcc/passes.c:1618
#12 0x00000000007f10ac in do_per_function_toporder (callback=0x7f1e90
<execute_pass_list>, data=0x160c880)
    at /mnt/svn/gcc-trunk/gcc/passes.c:1148
#13 0x00000000007f2346 in execute_ipa_pass_list (pass=0x160c9a0) at
/mnt/svn/gcc-trunk/gcc/passes.c:1934
#14 0x0000000000afd391 in ipa_passes () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1725
#15 cgraph_optimize () at /mnt/svn/gcc-trunk/gcc/cgraphunit.c:1797
#16 0x0000000000afd5ea in cgraph_finalize_compilation_unit () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1042
#17 0x000000000050585c in c_write_global_declarations () at
/mnt/svn/gcc-trunk/gcc/c-decl.c:9843
#18 0x00000000008dd544 in compile_file (argc=14, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:591
#19 do_compile (argc=14, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:1874
#20 toplev_main (argc=14, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:1937
#21 0x00007ffff65f1bbd in __libc_start_main () from /lib/libc.so.6
#22 0x00000000004ec455 in _start ()


Tested revisions:
r169155 - crash
4.5 r168785 - OK

[Bug tree-optimization/47443] [4.6 Regression] ICE: SSA name in freelist but still referenced or SIGSEGV with -fstack-check=generic

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47443

--- Comment #1 from Zdenek Sojka <zsojka at seznam dot cz> 2011-01-24 18:35:47 UTC ---
Created attachment 23103
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=23103
different crash

$ gcc -O -fstack-check=generic testcase2.c
testcase2.c: In function 'foo':
testcase2.c:13:1: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.


It crashes at different place, but maybe it's the same problem:
Program received signal SIGSEGV, Segmentation fault.
0x0000000000714225 in fold_comparison (loc=333, code=LT_EXPR,
type=0x7ffff7ed8498, op0=0x7ffff5d4b478, op1=0x7ffff5d4b898)
    at /mnt/svn/gcc-trunk/gcc/fold-const.c:8587
8587      if (POINTER_TYPE_P (TREE_TYPE (arg0))
(gdb) bt
#0  0x0000000000714225 in fold_comparison (loc=333, code=LT_EXPR,
type=0x7ffff7ed8498, op0=0x7ffff5d4b478, 
    op1=0x7ffff5d4b898) at /mnt/svn/gcc-trunk/gcc/fold-const.c:8587
#1  0x00000000006debf1 in fold_binary_loc (loc=333, code=LT_EXPR,
type=0x7ffff7ed8498, op0=0x7ffff5d4b478, 
    op1=0x7ffff5d4b898) at /mnt/svn/gcc-trunk/gcc/fold-const.c:12708
#2  0x00000000006f93a1 in fold_build2_stat_loc (loc=333, code=LT_EXPR,
type=0x7ffff7ed8498, op0=0x7ffff5d4b478, 
    op1=0x7ffff5d4b898) at /mnt/svn/gcc-trunk/gcc/fold-const.c:13982
#3  0x0000000000991baa in forward_propagate_into_gimple_cond
(stmt=0x7ffff5d3c460)
    at /mnt/svn/gcc-trunk/gcc/tree-ssa-forwprop.c:422
#4  0x0000000000991edd in tree_ssa_forward_propagate_single_use_vars () at
/mnt/svn/gcc-trunk/gcc/tree-ssa-forwprop.c:2085
#5  0x00000000007f1ba6 in execute_one_pass (pass=0x160d000) at
/mnt/svn/gcc-trunk/gcc/passes.c:1562
#6  0x00000000007f1ea5 in execute_pass_list (pass=0x160d000) at
/mnt/svn/gcc-trunk/gcc/passes.c:1617
#7  0x00000000007f1eb7 in execute_pass_list (pass=0x160c940) at
/mnt/svn/gcc-trunk/gcc/passes.c:1618
#8  0x00000000007f10ac in do_per_function_toporder (callback=0x7f1e90
<execute_pass_list>, data=0x160c880)
    at /mnt/svn/gcc-trunk/gcc/passes.c:1148
#9  0x00000000007f2346 in execute_ipa_pass_list (pass=0x160c9a0) at
/mnt/svn/gcc-trunk/gcc/passes.c:1934
#10 0x0000000000afd391 in ipa_passes () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1725
#11 cgraph_optimize () at /mnt/svn/gcc-trunk/gcc/cgraphunit.c:1797
#12 0x0000000000afd5ea in cgraph_finalize_compilation_unit () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1042
#13 0x000000000050585c in c_write_global_declarations () at
/mnt/svn/gcc-trunk/gcc/c-decl.c:9843
#14 0x00000000008dd544 in compile_file (argc=14, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:591
#15 do_compile (argc=14, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:1874
#16 toplev_main (argc=14, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:1937
#17 0x00007ffff65f1bbd in __libc_start_main () from /lib/libc.so.6
#18 0x00000000004ec455 in _start ()

[Bug tree-optimization/47443] [4.6 Regression] ICE: SSA name in freelist but still referenced or SIGSEGV with -fstack-check=generic

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47443

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |jakub at gcc dot gnu.org
         Resolution|                            |DUPLICATE

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-25 09:50:52 UTC ---
Apparently dup of PR47265, at least forward_propagate_addr_expr recurses there
too and after returning from the recursion suddenly one needed imm use
disappeared.

*** This bug has been marked as a duplicate of bug 47265 ***

[Bug tree-optimization/47443] [4.6 Regression] ICE: SSA name in freelist but still referenced or SIGSEGV with -fstack-check=generic

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47443

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-25 19:51:02 UTC ---
Author: jakub
Date: Tue Jan 25 19:50:56 2011
New Revision: 169250

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=169250
Log:
    PR tree-optimization/47265
    PR tree-optimization/47443
    * tree-ssa-forwprop.c (forward_propagate_addr_expr): Return false
    if name still has some uses.

    * gcc.c-torture/compile/pr47265.c: New test.
    * gcc.dg/pr47443.c: New test.

Added:
    trunk/gcc/testsuite/gcc.c-torture/compile/pr47265.c
    trunk/gcc/testsuite/gcc.dg/pr47443.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-forwprop.c

[Bug tree-optimization/47443] [4.6 Regression] ICE: SSA name in freelist but still referenced or SIGSEGV with -fstack-check=generic

[dnovillo at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47443

--- Comment #4 from Diego Novillo <dnovillo at gcc dot gnu.org> 2011-02-02 17:47:40 UTC ---
Author: dnovillo
Date: Wed Feb  2 17:47:35 2011
New Revision: 169589

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=169589
Log:
    PR tree-optimization/47265
    PR tree-optimization/47443
    * tree-ssa-forwprop.c (forward_propagate_addr_expr): Return false
    if name still has some uses.

    * gcc.c-torture/compile/pr47265.c: New test.
    * gcc.dg/pr47443.c: New test.

Added:
    branches/google/integration/gcc/testsuite/gcc.c-torture/compile/pr47265.c
    branches/google/integration/gcc/testsuite/gcc.dg/pr47443.c
Modified:
    branches/google/integration/gcc/ChangeLog
    branches/google/integration/gcc/testsuite/ChangeLog
    branches/google/integration/gcc/tree-ssa-forwprop.c