[Bug tree-optimization/49000] New: ICE: verify_ssa failed with -O2 -g

[Bug tree-optimization/49000] New: ICE: verify_ssa failed with -O2 -g

[arthur.j.odwyer at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

           Summary: ICE: verify_ssa failed with -O2 -g
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: arthur.j.odwyer@gmail.com


Created attachment 24248
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=24248
Output of "ajo-gcc -w -O2 -g test1426113557.c -v"

This reproduces for me with svn revision 173589 (2011-05-09). It doesn't
reproduce with gcc 4.5.1. I'm on Ubuntu 10.10, x86-64.

cat >test1426113557.c <<EOF
static MUL(int ui1, int ui2) {
  return (ui1) * (ui2);
}

static int func_60(int *p_61) {
    return (*p_61);
}

void func_97() {
    int l_234 = 42;
    int *l_342 = &l_234;
    MUL(func_60(&l_234), 3);
}

void func_1(void) {
    func_97();
}
EOF
gcc -w -O2 -g test1426113557.c

test1426113557.c: In function ‘func_1’:
test1426113557.c:17:1: error: expected an SSA_NAME object
test1426113557.c:17:1: error: in statement
# DEBUG D#1 => l_234
test1426113557.c:17:1: internal compiler error: verify_ssa failed


This test case is reduced from the output of Csmith 2.1.0 (git hash 541a6480,
https://github.com/csmith-project/csmith/), using the following command line:
csmith --no-paranoid --no-longlong --pointers --no-arrays --no-jumps
--no-consts --no-volatiles --checksum --no-divs --muls --no-bitfields
--no-packed-struct -s 1426113557

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011.05.14 23:45:11
                 CC|                            |iant at google dot com
   Target Milestone|---                         |4.6.1
            Summary|ICE: verify_ssa failed with |[4.6/4.7 Regression] ICE:
                   |-O2 -g                      |verify_ssa failed with -O2
                   |                            |-g
     Ever Confirmed|0                           |1

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> 2011-05-14 23:45:11 UTC ---
It is caused by revision 165964:

http://gcc.gnu.org/ml/gcc-cvs/2010-10/msg01151.html

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[ian at airs dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

Ian Lance Taylor <ian at airs dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ian at airs dot com,
                   |                            |jamborm at gcc dot gnu.org

--- Comment #2 from Ian Lance Taylor <ian at airs dot com> 2011-05-16 18:00:37 UTC ---
Extremely unlikely that that patch introduced the bug.  That patch just fixes a
bug introduced by

2010-09-10  Martin Jambor  <mjambor@suse.cz>

    PR tree-optimization/44972
    * ipa-prop.c (ipa_modify_call_arguments): Build MEM_REF instead of
    calling build_ref_for_offset.

Since that patch, Martin has rewritten the code further.

Adding Martin to CC in case this is somehow related to that work.

As far as I can see, the bug here is either that a GIMPLE_DEBUG statement has
been created with a memory op, or that gimple_has_mem_ops returns false for
GIMPLE_DEBUG.

It looks like the GIMPLE_DEBUG statement is created when l_234 is addressable,
but l_234 later becomes addressable due to inlining.  So something has to
change somewhere when that happens.

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[ian at airs dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

Ian Lance Taylor <ian at airs dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aoliva at gcc dot gnu.org

--- Comment #3 from Ian Lance Taylor <ian at airs dot com> 2011-05-16 18:01:25 UTC ---
Adding lxo as this is related to DEBUG insns.

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-17 08:19:15 UTC ---
TREE_ADDRESSABLE is cleared by maybe_optimize_var during
execute_update_addresses_taken.  If the debug stmt contains just the VAR_DECL,
it will be renamed, but in this case it is MEM_REF and for some reason isn't
renamed in that case (if I manually change it to the VAR_DECL, it is).
Later on fold_stmt_1 on the debug stmt performs maybe_fold_reference and
optimizes the MEM_REF into the VAR_DECL and triggers the checking failure.
If maybe_fold_reference is used already when the DEBUG stmt is created, it will
be just a VAR_DECL and thus it will work, but not sure if that is the way we
want to go.

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

--- Comment #5 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-05-17 09:40:20 UTC ---
(In reply to comment #4)
> TREE_ADDRESSABLE is cleared by maybe_optimize_var during
> execute_update_addresses_taken.  If the debug stmt contains just the VAR_DECL,
> it will be renamed, but in this case it is MEM_REF and for some reason isn't
> renamed in that case (if I manually change it to the VAR_DECL, it is).
> Later on fold_stmt_1 on the debug stmt performs maybe_fold_reference and
> optimizes the MEM_REF into the VAR_DECL and triggers the checking failure.
> If maybe_fold_reference is used already when the DEBUG stmt is created, it will
> be just a VAR_DECL and thus it will work, but not sure if that is the way we
> want to go.

Hm, I thought we fold all debug stmts initially.  Probably update-address-taken
should handle debug-stmts in the if (update_vops) path similar to how it
handles other mem-refs.  But I suppose it would have to drop debug stmts
in case it cannot rewrite them(?)

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-17 10:03:08 UTC ---
Not always, it is fine to keep say &a around even when a is no longer
addressable - then we emit is as (debug_implicit_ptr a).  So, if possible
ADDR_EXPR of the var should stay as is, but certainly what can be rewritten
should be.

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |jakub at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-17 16:33:56 UTC ---
Created attachment 24263
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=24263
gcc46-pr49000.patch

Untested fix.

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-17 17:03:00 UTC ---
Needs to be guarded additionally with && gimple_debug_bind_has_value_p (stmt)
otherwise it doesn't get too far.

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[arthur.j.odwyer at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

--- Comment #9 from Arthur O'Dwyer <arthur.j.odwyer at gmail dot com> 2011-05-18 00:48:32 UTC ---
Please also check any proposed fix against this second failure, which looks to
me as if it's caused by the same thing.  I've renamed homologous structures to
emphasize the similarity.

cat >test1875040564.c <<EOF
extern int g_5b;
static int *func_60b(int **p) { return *p; }
void func_97b(int *p_19b) {
    int *l_234b = &g_5b;
    int **l_25b = &l_234b;

    p_19b = func_60b(&l_234b);
    escape(0 == &p_19b);
}
int func_1b() {
  func_97b(0);
}
EOF
gcc -w -O2 -g -c test1875040564.c 

test1875040564.c: In function ‘func_1b’:
test1875040564.c:12:1: error: expected an SSA_NAME object
test1875040564.c:12:1: error: in statement
# DEBUG D#1 => l_234b
test1875040564.c:12:1: internal compiler error: verify_ssa failed

This second test case is reduced from the output of "csmith --no-paranoid
--longlong --pointers --arrays --jumps --no-consts --no-volatiles --no-checksum
--divs --no-muls --no-bitfields --no-packed-struct -s 1875040564".

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

--- Comment #10 from H.J. Lu <hjl.tools at gmail dot com> 2011-05-18 03:29:11 UTC ---
(In reply to comment #9)
> Please also check any proposed fix against this second failure, which looks to
> me as if it's caused by the same thing.  I've renamed homologous structures to
> emphasize the similarity.
> 
> cat >test1875040564.c <<EOF
> extern int g_5b;
> static int *func_60b(int **p) { return *p; }
> void func_97b(int *p_19b) {
>     int *l_234b = &g_5b;
>     int **l_25b = &l_234b;
> 
>     p_19b = func_60b(&l_234b);
>     escape(0 == &p_19b);
> }
> int func_1b() {
>   func_97b(0);
> }
> EOF
> gcc -w -O2 -g -c test1875040564.c 
> 
> test1875040564.c: In function ‘func_1b’:
> test1875040564.c:12:1: error: expected an SSA_NAME object
> test1875040564.c:12:1: error: in statement
> # DEBUG D#1 => l_234b
> test1875040564.c:12:1: internal compiler error: verify_ssa failed
> 
>

I think this is a difference bug.

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-18 06:05:53 UTC ---
It is the same bug actually and is also fixed by the patch.  I'll post the
patch momentarily.

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-18 09:22:45 UTC ---
Author: jakub
Date: Wed May 18 09:22:41 2011
New Revision: 173849

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=173849
Log:
    PR tree-optimization/49000
    * tree-ssa.c (execute_update_addresses_taken): Call
    maybe_rewrite_mem_ref_base on debug stmt value.  If it couldn't
    be rewritten and decl has been marked for renaming, reset
    the debug stmt.

    * gcc.dg/pr49000.c: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/pr49000.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa.c

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-18 09:31:31 UTC ---
Author: jakub
Date: Wed May 18 09:31:25 2011
New Revision: 173851

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=173851
Log:
    PR tree-optimization/49000
    * tree-ssa.c (execute_update_addresses_taken): Call
    maybe_rewrite_mem_ref_base on debug stmt value.  If it couldn't
    be rewritten and decl has been marked for renaming, reset
    the debug stmt.

    * gcc.dg/pr49000.c: New test.

Added:
    branches/gcc-4_6-branch/gcc/testsuite/gcc.dg/pr49000.c

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-18 09:29:57 UTC ---
Author: jakub
Date: Wed May 18 09:29:46 2011
New Revision: 173850

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=173850
Log:
    PR tree-optimization/49000
    * tree-ssa.c (execute_update_addresses_taken): Call
    maybe_rewrite_mem_ref_base on debug stmt value.  If it couldn't
    be rewritten and decl has been marked for renaming, reset
    the debug stmt.

    * gcc.dg/pr49000.c: New test.

Modified:
    branches/gcc-4_6-branch/gcc/ChangeLog
    branches/gcc-4_6-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_6-branch/gcc/tree-ssa.c

[Bug tree-optimization/49000] [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49000

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #15 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-23 09:24:02 UTC ---
Fixed.