[Bug tree-optimization/48813] Segfault with backward branch inside dead loop body

[Bug tree-optimization/48813] Segfault with backward branch inside dead loop body

[arthur.j.odwyer at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48813

--- Comment #1 from Arthur O'Dwyer <arthur.j.odwyer at gmail dot com> 2011-04-29 00:57:50 UTC ---
Created attachment 24136
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=24136
Output of "ajo-gcc -Os -funroll-loops -c test227972954.c -v" with gcc 4.7.0
from SVN

[Bug tree-optimization/48813] New: Segfault with backward branch inside dead loop body

[arthur.j.odwyer at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48813

           Summary: Segfault with backward branch inside dead loop body
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: arthur.j.odwyer@gmail.com


Created attachment 24135
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=24135
Output of "gcc -Os -funroll-loops -c test227972954.c -v" with gcc 4.4.5

This reproduces for me with svn revision 172950 (2011-04-25), and also with gcc
4.4.5, but strangely not with gcc 4.5.1.  I'm on Ubuntu 10.10, x86-64.

cat >test227972954.c <<EOF
extern unsigned int g_202;
extern int g_16, x;
extern void foo();
int func_103() {
  lbl_240:
    for (g_16 = 0; g_16 < 1; ++g_16) {
        foo();
        for (g_202 = 4; g_202 <= 3; ++g_202) {  /* loop body is dead */
            if (x)
              goto lbl_240;
        }
    }
    return 0;
}
EOF
gcc -Os -funroll-loops -c test227972954.c

test227972954.c: In function ‘func_103’:
test227972954.c:14:1: internal compiler error: Segmentation fault


gdb's stack trace looks like this:

Program received signal SIGSEGV, Segmentation fault.
0x00000000005aa45c in fix_bb_placements (from=0x7ffff6df0820, 
    irred_invalidated=0x7fffffffddfe "") at ../../gcc/cfgloopmanip.c:199
199      SET_BIT (in_queue, base_loop->header->index);
(gdb) backtrace
#0  0x00000000005aa45c in fix_bb_placements (from=0x7ffff6df0820, 
    irred_invalidated=0x7fffffffddfe "") at ../../gcc/cfgloopmanip.c:199
#1  0x00000000005aab22 in fix_loop_placements (e=<value optimized out>)
    at ../../gcc/cfgloopmanip.c:858
#2  remove_path (e=<value optimized out>) at ../../gcc/cfgloopmanip.c:388
#3  0x0000000000745fc6 in peel_loop_completely (flags=6)
    at ../../gcc/loop-unroll.c:514
#4  peel_loops_completely (flags=6) at ../../gcc/loop-unroll.c:256
#5  unroll_and_peel_loops (flags=6) at ../../gcc/loop-unroll.c:165
[...]


This test case is reduced from the output of Csmith
(http://embed.cs.utah.edu/csmith/), using the following command line:
csmith --bitfields --packed-struct -s 227972954 > test227972954.c

[Bug tree-optimization/48813] [4.4/4.5/4.6/4.7 Regression] Segfault with backward branch inside dead loop body

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48813

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |x86_64-*-*
             Status|UNCONFIRMED                 |NEW
      Known to work|4.5.1                       |4.3.5
           Keywords|                            |ice-on-valid-code
   Last reconfirmed|                            |2011.04.29 09:45:48
     Ever Confirmed|0                           |1
            Summary|Segfault with backward      |[4.4/4.5/4.6/4.7
                   |branch inside dead loop     |Regression] Segfault with
                   |body                        |backward branch inside dead
                   |                            |loop body
   Target Milestone|---                         |4.4.7
      Known to fail|                            |4.5.1, 4.6.0

--- Comment #2 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-04-29 09:45:48 UTC ---
Confirmed.  Fails for me since 4.4.0.

[Bug rtl-optimization/48813] [4.4/4.5/4.6/4.7 Regression] Segfault with backward branch inside dead loop body

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48813

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-04-29 14:18:10 UTC ---
Started with http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=139234
so might very well be latent before that.

Slightly cleaned up testcase:

/* PR rtl-optimization/48813 */
/* { dg-do compile } */
/* { dg-options "-Os -funroll-loops" } */

extern int a, b, c;
extern void foo (void);

int
bar (void)
{
  for (b = 0; b < 1; b++)
    {
      foo ();
      for (a = 2; a <= 1; a++)
        if (c)
          return bar ();
    }
  return 0;
}

[Bug rtl-optimization/48813] [4.4/4.5/4.6/4.7 Regression] Segfault with backward branch inside dead loop body

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48813

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug rtl-optimization/48813] [4.4/4.5/4.6 Regression] Segfault with backward branch inside dead loop body

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48813

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.7.0
         Depends on|                            |49710
            Summary|[4.4/4.5/4.6/4.7            |[4.4/4.5/4.6 Regression]
                   |Regression] Segfault with   |Segfault with backward
                   |backward branch inside dead |branch inside dead loop
                   |loop body                   |body

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> 2012-01-20 03:48:56 UTC ---
Fixed on the trunk by PR 49710.

[Bug rtl-optimization/48813] [4.5/4.6 Regression] Segfault with backward branch inside dead loop body

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48813

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.4.7                       |4.5.4

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-03-13 12:46:35 UTC ---
4.4 branch is being closed, moving to 4.5.4 target.

[Bug rtl-optimization/48813] [4.5/4.6 Regression] Segfault with backward branch inside dead loop body

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48813

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.5.4                       |4.6.4

--- Comment #6 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-07-02 12:12:07 UTC ---
The 4.5 branch is being closed, adjusting target milestone.

[Bug rtl-optimization/48813] [4.6 Regression] Segfault with backward branch inside dead loop body

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48813

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED
   Target Milestone|4.6.4                       |4.7.0

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-04-12 16:18:03 UTC ---
The 4.6 branch has been closed, fixed in GCC 4.7.0.