[Bug middle-end/50295] New: [4.6 Regression] ICE (segfault) in expand_debug_expr at cfgexpand.c:2380

[Bug middle-end/50295] New: [4.6 Regression] ICE (segfault) in expand_debug_expr at cfgexpand.c:2380

[doko at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50295

             Bug #: 50295
           Summary: [4.6 Regression] ICE (segfault) in expand_debug_expr
                    at cfgexpand.c:2380
    Classification: Unclassified
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: doko@gcc.gnu.org


Created attachment 25197
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25197
preprocessed source

seen with 4.6 20110903 on i686-linux-gnu, with -Os and -O2, works with -O1 and
-O0, works with -Os and -O2 when omitting -g.

The ICE is triggered by the nsrefcnt WyciwygChannelChild::AddRef line, omitting
this line doesn't show the ICE.

$ gcc -c -g -O2 -std=gnu++0x  WyciwygChannelChild.ii 
/home/chrisccoulson/src/firefox/firefox-7.0~b4+build2+nobinonly/build-tree/mozilla/netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp:
In member function 'virtual nsresult
mozilla::net::WyciwygChannelChild::CloseCacheEntry(nsresult)':
/home/chrisccoulson/src/firefox/firefox-7.0~b4+build2+nobinonly/build-tree/mozilla/netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp:605:1:
internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.

Program received signal SIGSEGV, Segmentation fault.
0x0820cec8 in expand_debug_expr (exp=0xf28c5d50) at
../../gcc-4_6-branch/gcc/cfgexpand.c:2380
2380      enum machine_mode mode = TYPE_MODE (TREE_TYPE (exp));
(gdb) bt
#0  0x0820cec8 in expand_debug_expr (exp=0xf28c5d50) at
../../gcc-4_6-branch/gcc/cfgexpand.c:2380
#1  0x08210208 in expand_debug_locations () at
../../gcc-4_6-branch/gcc/cfgexpand.c:3316
#2  gimple_expand_cfg () at ../../gcc-4_6-branch/gcc/cfgexpand.c:4112
#3  0x08366147 in execute_one_pass (pass=0x8aa5780) at
../../gcc-4_6-branch/gcc/passes.c:1556
#4  0x083663f5 in execute_pass_list (pass=0x8aa5780) at
../../gcc-4_6-branch/gcc/passes.c:1611
#5  0x08434ac5 in tree_rest_of_compilation (fndecl=0xf3447d80) at
../../gcc-4_6-branch/gcc/tree-optimize.c:422
#6  0x085711f9 in cgraph_expand_function (node=0xf3342000) at
../../gcc-4_6-branch/gcc/cgraphunit.c:1576
#7  0x08572f85 in cgraph_expand_all_functions () at
../../gcc-4_6-branch/gcc/cgraphunit.c:1635
#8  cgraph_optimize () at ../../gcc-4_6-branch/gcc/cgraphunit.c:1899
#9  0x08573405 in cgraph_finalize_compilation_unit () at
../../gcc-4_6-branch/gcc/cgraphunit.c:1096
#10 0x0812682b in cp_write_global_declarations () at
../../gcc-4_6-branch/gcc/cp/decl2.c:4000
#11 0x083f800d in compile_file () at ../../gcc-4_6-branch/gcc/toplev.c:591
#12 do_compile () at ../../gcc-4_6-branch/gcc/toplev.c:1900
#13 toplev_main (argc=16, argv=0xffffd6c4) at
../../gcc-4_6-branch/gcc/toplev.c:1963
#14 0x080d018b in main (argc=16, argv=0xffffd6c4) at
../../gcc-4_6-branch/gcc/main.c:36

[Bug middle-end/50295] [4.6 Regression] ICE (segfault) in expand_debug_expr at cfgexpand.c:2380

[doko at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50295

--- Comment #1 from Matthias Klose <doko at gcc dot gnu.org> 2011-09-05 15:52:11 UTC ---
caused by 

r178482 | jamborm | 2011-09-02 16:30:34 +0200 (Fri, 02 Sep 2011) | 10 lines

2011-09-02  Martin Jambor  <mjambor@suse.cz>

        PR middle-end/49886
        * ipa-split.c (split_function): Do not skip any arguments if
        can_change_signature is set or there are function type attributes.

        * testsuite/gcc.c-torture/execute/pr49886.c: New testcase.
        * testsuite/gfortran.fortran-torture/compile/pr50260.f90: Likewise.

[Bug middle-end/50295] [4.6 Regression] ICE (segfault) in expand_debug_expr at cfgexpand.c:2380

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50295

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011-09-06
            Version|unknown                     |4.6.2
   Target Milestone|---                         |4.6.2
     Ever Confirmed|0                           |1

--- Comment #2 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-09-06 08:01:29 UTC ---
Confirmed.  Reducing (I think it's a dup).

[Bug middle-end/50295] [4.6 Regression] ICE (segfault) in expand_debug_expr at cfgexpand.c:2380

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50295

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aoliva at gcc dot gnu.org,
                   |                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-09-06 08:15:21 UTC ---
We have:
<bb 4>:
# DEBUG this => this_2(D)
reason_15 = reason_10(D);
reason_17 = reason_15;
# DEBUG reason => reason_17
D.137092_16 = &this_2(D)->D.122214;
mozilla::net::PWyciwygChannelChild::Send__delete__ (D.137092_16);
D.132395_6 = 0;

and ccp (substitute_and_fold called from ccp_finalize) decides (because
has_zero_uses is true for reason_17) to remove reason_17 = reason_15; stmt
first, which during gsi_remove adds a # DEBUG D#xxx => reason_15 stmt.
Then reason_15 = reason_10(D); is being removed, but for some reason the newly
added debug stmt isn't found during FOR_EACH_IMM_USE_FAST for reason_15.

[Bug middle-end/50295] [4.6 Regression] ICE (segfault) in expand_debug_expr at cfgexpand.c:2380

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50295

--- Comment #4 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-09-06 08:23:15 UTC ---
That would be the case if we're missing an update_stmt on the debug stmt.

[Bug middle-end/50295] [4.6 Regression] ICE (segfault) in expand_debug_expr at cfgexpand.c:2380

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50295

--- Comment #5 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-09-06 08:26:44 UTC ---
Because gimple_build_debug_bind_stat does not set the stmt to modified?  So
it's not automatically updated on gsi_insert_before ().

[Bug middle-end/50295] [4.6 Regression] ICE (segfault) in expand_debug_expr at cfgexpand.c:2380

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50295

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-09-06 08:29:58 UTC ---
It is gimple_modified_p and gsi_insert_before does call build_stmt_operands on
it.  Still debugging...

[Bug middle-end/50295] [4.6 Regression] ICE (segfault) in expand_debug_expr at cfgexpand.c:2380

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50295

--- Comment #7 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-09-06 11:59:46 UTC ---
Created attachment 25201
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25201
reduced testcase

[Bug middle-end/50295] [4.6 Regression] ICE (segfault) in expand_debug_expr at cfgexpand.c:2380

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50295

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|mjambor at suse dot cz      |jamborm at gcc dot gnu.org
         Resolution|                            |DUPLICATE

--- Comment #8 from Martin Jambor <jamborm at gcc dot gnu.org> 2011-09-06 18:27:30 UTC ---
I have reverted the patch causing this on the 4.6 branch.  As far as trunk is
concerned, I'll track it in a duplicate of this bug, PR 50287.

*** This bug has been marked as a duplicate of bug 50287 ***