[Bug middle-end/50200] New: ICE: SIGSEGV in df_insn_refs_collect (df-scan.c:3405)

[Bug middle-end/50200] New: ICE: SIGSEGV in df_insn_refs_collect (df-scan.c:3405)

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50200

             Bug #: 50200
           Summary: ICE: SIGSEGV in df_insn_refs_collect (df-scan.c:3405)
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: zsojka@seznam.cz
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu


Created attachment 25112
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25112
reduced testcase

Compiler output:
$ gcc -O -fno-tree-ch -fno-tree-dominator-opts -fno-tree-loop-optimize
-funroll-loops --param case-values-threshold=1 testcase.c
==27091== Invalid read of size 8
==27091==    at 0x6C5887: df_insn_refs_collect(df_collection_rec*,
basic_block_def*, df_insn_info*) (df-scan.c:3405)
==27091==    by 0x6C643A: df_insn_refs_verify(df_collection_rec*,
basic_block_def*, rtx_def*, bool) (df-scan.c:4343)
==27091==    by 0x6C67AA: df_bb_verify(basic_block_def*) (df-scan.c:4392)
==27091==    by 0x6C9081: df_scan_verify() (df-scan.c:4526)
==27091==    by 0x6B2A88: df_verify() (df-core.c:1644)
==27091==    by 0x6B2BBE: df_analyze() (df-core.c:1205)
==27091==    by 0x113E039: rest_of_handle_initialize_regs() (init-regs.c:60)
==27091==    by 0x8E6216: execute_one_pass(opt_pass*) (passes.c:2063)
==27091==    by 0x8E6584: execute_pass_list(opt_pass*) (passes.c:2118)
==27091==    by 0x8E6596: execute_pass_list(opt_pass*) (passes.c:2119)
==27091==    by 0xA3E87D: tree_rest_of_compilation(tree_node*)
(tree-optimize.c:420)
==27091==    by 0x6936B5: cgraph_expand_function(cgraph_node*)
(cgraphunit.c:1797)
==27091==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==27091== 
testcase.c: In function 'check':
testcase.c:22:1: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

Tested revisions:
r178096 - crash
r177543 - crash

[Bug middle-end/50200] ICE: SIGSEGV in df_insn_refs_collect (df-scan.c:3405)

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50200

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> 2012-01-19 05:42:43 UTC ---
This works on the trunk for me.

[Bug middle-end/50200] ICE: SIGSEGV in df_insn_refs_collect (df-scan.c:3405)

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50200

--- Comment #2 from Zdenek Sojka <zsojka at seznam dot cz> 2012-01-19 11:03:26 UTC ---
Created attachment 26376
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26376
testcase failing in r183270

Both testcases were reduced from testsuite/gcc.c-torture/execute/pr44575.c

Compiler output: (-fno-tree-dominator-opts is no longer needed)
$ gcc -O -fno-tree-ch -fno-tree-loop-optimize -funroll-loops
--param=case-values-threshold=1 testcase2.c
==27252== Invalid read of size 8
==27252==    at 0x6E2984: df_insn_refs_collect(df_collection_rec*,
basic_block_def*, df_insn_info*) (df-scan.c:3406)
==27252==    by 0x6E34D9: df_insn_refs_verify(df_collection_rec*,
basic_block_def*, rtx_def*, bool) (df-scan.c:4344)
==27252==    by 0x6E382C: df_bb_verify(basic_block_def*) (df-scan.c:4393)
==27252==    by 0x6E6077: df_scan_verify() (df-scan.c:4527)
==27252==    by 0x6D00F8: df_verify() (df-core.c:1644)
==27252==    by 0x6D0228: df_analyze() (df-core.c:1205)
==27252==    by 0x112A969: rest_of_handle_initialize_regs() (init-regs.c:60)
==27252==    by 0x8FAD84: execute_one_pass(opt_pass*) (passes.c:2081)
==27252==    by 0x8FB144: execute_pass_list(opt_pass*) (passes.c:2136)
==27252==    by 0x8FB156: execute_pass_list(opt_pass*) (passes.c:2137)
==27252==    by 0xA5D25D: tree_rest_of_compilation(tree_node*)
(tree-optimize.c:420)
==27252==    by 0x6AFC39: cgraph_expand_function(cgraph_node*)
(cgraphunit.c:1818)
==27252==    by 0x6B1B0B: cgraph_optimize() (cgraphunit.c:1885)
==27252==    by 0x6B2169: cgraph_finalize_compilation_unit()
(cgraphunit.c:1327)
==27252==    by 0x58F0BF: c_write_global_declarations() (c-decl.c:10030)
==27252==    by 0x9EFD1B: toplev_main(int, char**) (toplev.c:573)
==27252==    by 0x66E009C: (below main) (in /lib64/libc-2.13.so)
==27252==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==27252== 
testcase2.c: In function 'foo':
testcase2.c:22:1: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.


When -fno-web is added, it ICEs at a different place:
$ gcc -O -fno-tree-ch -fno-tree-loop-optimize -funroll-loops
--param=case-values-threshold=1 testcase2.c -fno-web
testcase2.c: In function 'foo':
testcase2.c:22:1: internal compiler error: in remove_insn, at emit-rtl.c:3980
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.
(gdb) bt
#0  fancy_abort (file=0x125fac8 "/mnt/svn/gcc-trunk/gcc/emit-rtl.c", line=3980,
function=0x1260cc1 "remove_insn")
    at /mnt/svn/gcc-trunk/gcc/diagnostic.c:898
#1  0x000000000073ef9c in remove_insn (insn=0x7ffff5bd0678) at
/mnt/svn/gcc-trunk/gcc/emit-rtl.c:3980
#2  0x000000000069c221 in delete_insn (insn=0x7ffff5bd0678) at
/mnt/svn/gcc-trunk/gcc/cfgrtl.c:145
#3  0x00000000006a3548 in delete_insn_and_edges (insn=<optimized out>) at
/mnt/svn/gcc-trunk/gcc/cfgrtl.c:209
#4  0x00000000010d4f6a in delete_unmarked_insns () at
/mnt/svn/gcc-trunk/gcc/dce.c:591
#5  0x00000000010d7a99 in fast_dce (word_level=false) at
/mnt/svn/gcc-trunk/gcc/dce.c:1038
#6  0x00000000010d7d05 in rest_of_handle_fast_dce () at
/mnt/svn/gcc-trunk/gcc/dce.c:1052
#7  0x00000000010d84e9 in run_fast_df_dce () at
/mnt/svn/gcc-trunk/gcc/dce.c:1100
#8  0x00000000006d59f9 in df_lr_finalize (all_blocks=0x19f2208) at
/mnt/svn/gcc-trunk/gcc/df-problems.c:1019
#9  0x00000000006cf64a in df_analyze_problem (dflow=0x1942490,
blocks_to_consider=0x19f2208, postorder=0x1a09db0, n_blocks=8)
    at /mnt/svn/gcc-trunk/gcc/df-core.c:1161
#10 0x00000000006d02fa in df_analyze () at
/mnt/svn/gcc-trunk/gcc/df-core.c:1252
#11 0x0000000001127113 in if_convert () at /mnt/svn/gcc-trunk/gcc/ifcvt.c:4372
#12 0x0000000001128b49 in rest_of_handle_if_after_combine () at
/mnt/svn/gcc-trunk/gcc/ifcvt.c:4497
#13 0x00000000008fad85 in execute_one_pass (pass=0x17ca060) at
/mnt/svn/gcc-trunk/gcc/passes.c:2081
#14 0x00000000008fb145 in execute_pass_list (pass=0x17ca060) at
/mnt/svn/gcc-trunk/gcc/passes.c:2136
#15 0x00000000008fb157 in execute_pass_list (pass=0x17c4f40) at
/mnt/svn/gcc-trunk/gcc/passes.c:2137
#16 0x0000000000a5d25e in tree_rest_of_compilation (fndecl=0x7ffff5ba6d00) at
/mnt/svn/gcc-trunk/gcc/tree-optimize.c:420
#17 0x00000000006afc3a in cgraph_expand_function (node=0x7ffff5a976c0) at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1818
#18 0x00000000006b1b0c in cgraph_expand_all_functions () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1885
#19 cgraph_optimize () at /mnt/svn/gcc-trunk/gcc/cgraphunit.c:2199
#20 0x00000000006b216a in cgraph_finalize_compilation_unit () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1327
#21 0x000000000058f0c0 in c_write_global_declarations () at
/mnt/svn/gcc-trunk/gcc/c-decl.c:10030
#22 0x00000000009efd1c in compile_file () at
/mnt/svn/gcc-trunk/gcc/toplev.c:573
#23 do_compile () at /mnt/svn/gcc-trunk/gcc/toplev.c:1938
#24 toplev_main (argc=19, argv=0x7fffffffd7d8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:2014
#25 0x00007ffff61cc09d in __libc_start_main () from /lib64/libc.so.6
#26 0x00000000005727d1 in _start ()

[Bug middle-end/50200] ICE: SIGSEGV in df_insn_refs_collect (df-scan.c:3405)

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50200

--- Comment #3 from Zdenek Sojka <zsojka at seznam dot cz> 2012-01-19 13:26:32 UTC ---
Testcase from comment #2 still ICEs in r183298, the fix for PR51505 didn't help
here.

[Bug middle-end/50200] ICE: SIGSEGV in df_insn_refs_collect (df-scan.c:3405)

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50200

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |mpolacek at gcc dot gnu.org
         Resolution|                            |FIXED

--- Comment #4 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-04-04 07:03:53 UTC ---
This one should be fixed as well (4.6/4.7/4.8/trunk).