[Bug tree-optimization/50764] New: [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[Bug tree-optimization/50764] New: [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

             Bug #: 50764
           Summary: [4.7 Regression] ICE: in maybe_record_trace_start, at
                    dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks
                    -ftree-tail-merge
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: zsojka@seznam.cz
                CC: vries@gcc.gnu.org
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu


Created attachment 25528
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25528
reduced testcase

Compiler output:
$ gcc -O2 -fsched2-use-superblocks testcase.c
testcase.c: In function 'foo':
testcase.c:13:1: internal compiler error: in maybe_record_trace_start, at
dwarf2cfi.c:2243
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

Maybe related to -ftree-tail-merge, as it doesn't crash with
-fno-tree-tail-merge.

Tested revisions:
r180072 - crash
r179959 - crash
r178498 - OK
4.6 r177922 - OK

[Bug tree-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

--- Comment #1 from vries at gcc dot gnu.org 2011-10-17 21:55:12 UTC ---
Created attachment 25535
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25535
sdiff between 091t.crited and 092t.pre

I don't seen anything obviously wrong with the transformation by
-ftree-tail-merge.
Block 6 and block 7 have the same successor (block 4) and are both empty, so
equal.
Block 7 is removed, the incoming edge of block 7 is redirected to block 6, and
a virtual phi is inserted at the start of block 6.

[Bug tree-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011-10-18
   Target Milestone|---                         |4.7.0
     Ever Confirmed|0                           |1

--- Comment #2 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-10-18 09:54:33 UTC ---
Confirmed.

[Bug tree-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug tree-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

--- Comment #3 from vries at gcc dot gnu.org 2011-10-27 14:32:45 UTC ---
Created attachment 25633
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25633
sdiff between 209r.split4 (before sched2) -fno-tree-tail-merge and
-ftree-tail-merge

differences between the 2:
- the position of a dead code_label (code_label 33 vs. code_label 23)
- the presence of DImode on label_refs (insn 19 vs insn 19,  insn 26 vs insn
31)

[Bug tree-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

--- Comment #4 from vries at gcc dot gnu.org 2011-10-27 15:29:10 UTC ---
Created attachment 25634
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25634
sdiff between 209r.split4 and 210r.sched2 with -ftree-tail-merge

The effect of -fsched2-use-superblocks (with -ftree-tail-merge) is that note 59
and insn 51 are moved from block 4 to block 3.
...
(note 59 27 51 3 NOTE_INSN_EPILOGUE_BEG)

(insn/f 51 50 52 4 (set (reg:DI 39 r10)
        (mem/c:DI (plus:DI (reg/f:DI 6 bp)
                (const_int -8 [0xfffffffffffffff8])) [3 S8 A8])) pr50764.c:13
62 {*movdi_internal_rex64}
     (expr_list:REG_CFA_DEF_CFA (reg:DI 39 r10)
        (nil)))
...

block 4 contains a return, and block 3 jumps either to block 4 or block 5,
which calls abort.

           2
          bar
           |
    -------+-----
   /             \
  *               *
  5 *------------ 3
abort            bar
                  |
                  |
                  *
                  4
                return

The move looks ok, bp and memory are not modified in between the original and
new position, and r10 does not overwrite a value in block 3 or 5. 

Possibly the dead label at the start of block 4 prevents this move in case of
-fno-tree-tail-merge.

[Bug tree-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

--- Comment #5 from vries at gcc dot gnu.org 2011-10-27 15:54:07 UTC ---
during 223r.dwarf2, maybe_record_trace_start is called with lab == code_label
29, at the start of block 5, and we hit the assert:
...
      gcc_checking_assert (cfi_row_equal_p (cur_row, ti->beg_row));
...

The difference between cur_row and ti->beg_row can be seen here:
...
(gdb) p *cur_row
$4 = {cfa = {offset = 0, base_offset = 0, reg = 10, indirect = 0, in_use = 0},
cfa_cfi = 0x0, reg_save = 0x7ffff554a980}
(gdb) p *ti->beg_row
$6 = {cfa = {offset = 0, base_offset = -8, reg = 6, indirect = 1, in_use = 0},
cfa_cfi = 0x7ffff5696b70, reg_save = 0x7ffff554a850}
...

Apparently moving REG_CFA_DEF_CFA (reg:DI 39 r10) from block 4 to block 3
causes a different CFA state at the beginning of block 5, depending on whether
you arrive there from block 3 or block 2.

I don't know enough about dwarf to say whether the assert is ok or not, but it
seems to me that either the assert is wrong, or -fsched2-use-superblocks.

[Bug tree-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

vries at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rth at gcc dot gnu.org

--- Comment #6 from vries at gcc dot gnu.org 2011-10-27 20:43:15 UTC ---
Richard,

Can you confirm that the assert triggers correctly?

Thanks,
- Tom

[Bug rtl-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

vries at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|tree-optimization           |rtl-optimization

--- Comment #7 from vries at gcc dot gnu.org 2011-10-29 12:28:23 UTC ---
Using this patch, the dead label introduced by cfg_layout_finalize is removed:
...
Index: gcc/bb-reorder.c
===================================================================
--- gcc/bb-reorder.c (revision 180521)
+++ gcc/bb-reorder.c (working copy)
@@ -2328,6 +2328,7 @@ rest_of_handle_reorder_blocks (void)
     if (bb->next_bb != EXIT_BLOCK_PTR)
       bb->aux = bb->next_bb;
   cfg_layout_finalize ();
+  cleanup_cfg (0);

   /* Add NOTE_INSN_SWITCH_TEXT_SECTIONS notes.  */
   insert_section_boundary_note ();
...
and the assert triggers for -O2 -fsched2-use-superblocks -fno-tree-tail-merge.
Changing component to rtl-optimization.

[Bug rtl-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

--- Comment #8 from vries at gcc dot gnu.org 2011-10-29 12:32:37 UTC ---
> Using this patch, the dead label introduced by cfg_layout_finalize is removed:

To be more precise: Using this patch, the dead label introduced by
cfg_layout_finalize is removed before sched2 (in pass_reorder_blocks) rather
than after sched2 (in pass_duplicate_computed_gotos).

[Bug rtl-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

--- Comment #9 from vries at gcc dot gnu.org 2011-10-29 17:16:11 UTC ---
Using the bb-reorder patch, the assert is introduced/triggered by r177209:
...
r177209 | rth | 2011-08-02 21:56:29 +0200 (Tue, 02 Aug 2011) | 5 lines

h8300: Generate correct unwind info around swap_into/out_of_er6.

Minimal bug fix is to unset RTX_FRAME_RELATED_P on the PUSH
insn generated in h8300_swap_into_er6.  But with a tiny bit
of effort we can generate real unwind info around the sequence.
...

[Bug rtl-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

--- Comment #10 from vries at gcc dot gnu.org 2011-10-30 07:39:36 UTC ---
Tentative patch at http://gcc.gnu.org/ml/gcc-patches/2011-10/msg02767.html

[Bug rtl-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

Michael Matz <matz at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |matz at gcc dot gnu.org

--- Comment #11 from Michael Matz <matz at gcc dot gnu.org> 2011-11-21 16:23:00 UTC ---
That sched2 moves frame related instructions into paths that didn't have
them before seems dubious.  The assert is correct in sofar as triggering
implies generating wrong unwind info:  Depending on if bb5 (the abort) would
be placed after or before bb 3, it would have wrong unwind info for the
path 2->5 (CFA would be r10, but it wouldn't be set up) or 3->5 (CFA would
be r6, but due to the push at the wrong offset).

I think the dead-label moving just exposes the bug in sched2.

[Bug rtl-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

--- Comment #12 from vries at gcc dot gnu.org 2011-11-22 20:55:06 UTC ---
Author: vries
Date: Tue Nov 22 20:55:01 2011
New Revision: 181639

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=181639
Log:
2011-11-22  Tom de Vries  <tom@codesourcery.com>

    PR rtl-optimization/50764
    * sched-deps.c (sched_analyze_insn): Make sure frame-related insns are
    not moved past preceding jump.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/sched-deps.c

[Bug rtl-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

--- Comment #13 from vries at gcc dot gnu.org 2011-11-22 20:55:13 UTC ---
Author: vries
Date: Tue Nov 22 20:55:10 2011
New Revision: 181640

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=181640
Log:
2011-11-22  Tom de Vries  <tom@codesourcery.com>

    PR rtl-optimization/50764
    * gcc.dg/pr50764.c: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/pr50764.c
Modified:
    trunk/gcc/testsuite/ChangeLog

[Bug rtl-optimization/50764] [4.7 Regression] ICE: in maybe_record_trace_start, at dwarf2cfi.c:2243 with -O2 -fsched2-use-superblocks -ftree-tail-merge

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50764

vries at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #14 from vries at gcc dot gnu.org 2011-11-22 21:01:02 UTC ---
Patch and test-case checked in, marking resolved fixed.