[Bug tree-optimization/51990] New: ICE in copy_reference_ops_from_ref

[Bug tree-optimization/51990] New: ICE in copy_reference_ops_from_ref

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51990

             Bug #: 51990
           Summary: ICE in copy_reference_ops_from_ref
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: vries@gcc.gnu.org


example test.c, based on gcc.c-torture/compile/20030224-1.c. Added pure to foo
and used result of foo to trigger visit_reference_op_call:
...
int
zzz (char *s1, char *s2, int len, int *q)
{
  int z = 5;
  unsigned int i,  b;
  struct s { char a[z]; };
  struct s x; 

  extern int foo (struct s, struct s) __attribute__((pure));

  for (i = 0; i < len; i++)
    s1[i] = s2[i];

  b = z & 0x3;

  len += (b == 0 ? 0 : 1) + z;

  *q = len;

  return foo (x, x);
}
...

compile ICEs with trunk r183325:
...
$ gcc -O2 test.c -S
test.c: In function ‘zzz’:
test.c:21:1: internal compiler error: in copy_reference_ops_from_ref, at
tree-ssa-sccvn.c:738
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.
...

backtrace:
...
(gdb) bt
#0  exit (status=4) at exit.c:49
#1  0x0000000001f15ebb in diagnostic_action_after_output (context=0x2730620,
diagnostic=0x7fffffffd3e0) at /home/vries/devel/src/gcc/diagnostic.c:243
#2  0x0000000001f16d8d in diagnostic_report_diagnostic (context=0x2730620,
diagnostic=0x7fffffffd3e0) at /home/vries/devel/src/gcc/diagnostic.c:552
#3  0x0000000001f17dac in internal_error (gmsgid=0x225a7a7 "in %s, at %s:%d")
at /home/vries/devel/src/gcc/diagnostic.c:845
#4  0x0000000001f17f34 in fancy_abort (file=0x2043eb0
"/home/vries/devel/src/gcc/tree-ssa-sccvn.c", line=738, function=0x2045000
"copy_reference_ops_from_ref") at /home/vries/devel/src/gcc/diagnostic.c:899
#5  0x0000000000ef9dd8 in copy_reference_ops_from_ref (ref=0x7ffff565eba0,
result=0x271b1d8) at /home/vries/devel/src/gcc/tree-ssa-sccvn.c:738
#6  0x0000000000efaae1 in copy_reference_ops_from_call (call=0x7ffff554a720,
result=0x271b1d8) at /home/vries/devel/src/gcc/tree-ssa-sccvn.c:951
#7  0x0000000000efc906 in valueize_shared_reference_ops_from_call
(call=0x7ffff554a720) at /home/vries/devel/src/gcc/tree-ssa-sccvn.c:1272
#8  0x0000000000f018b4 in visit_reference_op_call (lhs=0x7ffff5664a00,
stmt=0x7ffff554a720) at /home/vries/devel/src/gcc/tree-ssa-sccvn.c:2596
#9  0x0000000000f04359 in visit_use (use=0x7ffff5664a00) at
/home/vries/devel/src/gcc/tree-ssa-sccvn.c:3364
#10 0x0000000000f04b5f in process_scc (scc=0x27493f0) at
/home/vries/devel/src/gcc/tree-ssa-sccvn.c:3505
#11 0x0000000000f052a0 in extract_and_process_scc_for_name
(name=0x7ffff5664a00) at /home/vries/devel/src/gcc/tree-ssa-sccvn.c:3589
#12 0x0000000000f05466 in DFS (name=0x7ffff5664a00) at
/home/vries/devel/src/gcc/tree-ssa-sccvn.c:3643
#13 0x0000000000f06028 in run_scc_vn (default_vn_walk_kind_=VN_WALKREWRITE) at
/home/vries/devel/src/gcc/tree-ssa-sccvn.c:3892
#14 0x0000000000ee1f38 in execute_pre (do_fre=1 '\001') at
/home/vries/devel/src/gcc/tree-ssa-pre.c:4870
#15 0x0000000000ee2192 in execute_fre () at
/home/vries/devel/src/gcc/tree-ssa-pre.c:4988
...


Cause of ICE: unhandled WITH_SIZE_EXPR in switch (temp.opcode):
...
#5  0x0000000000ef9dd8 in copy_reference_ops_from_ref (ref=0x7ffff565eba0,
result=0x271b1d8) at /home/vries/devel/src/gcc/tree-ssa-sccvn.c:738
738          gcc_unreachable ();
(gdb) call debug_generic_expr (ref)
WITH_SIZE_EXPR <*x.1_20, 5>
...

20030224-1.c.027t.esra (dump before 20030224-1.c.028t.fre1):
...
zzz (char * s1, char * s2, int len, int * q)
{
  <unnamed-unsigned:8> D.1744[5];
  unsigned int i;
  void * saved_stack.4;
  int D.1739;
  unsigned int len.2;
  char D.1733;
  char * D.1732;
  char * D.1731;
  sizetype D.1730;
  struct s * x.1;
  sizetype D.1724;

<bb 2>:
  saved_stack.4_2 = __builtin_stack_save ();
  D.1724_19 = 5;
  x.1_20 = &D.1744;
  i_21 = 0;
  goto <bb 4>;

<bb 3>:
  D.1730_24 = (sizetype) i_1;
  D.1731_26 = s1_25(D) + D.1730_24;
  D.1730_27 = (sizetype) i_1;
  D.1732_29 = s2_28(D) + D.1730_27;
  D.1733_30 = *D.1732_29;
  *D.1731_26 = D.1733_30;
  i_31 = i_1 + 1;

<bb 4>:
  # i_1 = PHI <0(2), i_31(3)>
  len.2_23 = (unsigned int) len_22(D);
  if (len.2_23 > i_1)
    goto <bb 3>;
  else
    goto <bb 5>;

<bb 5>:
  len_37 = len_22(D) + 6;
  *q_38(D) = len_37;
  D.1739_39 = foo (WITH_SIZE_EXPR <*x.1_20, 5>, WITH_SIZE_EXPR <*x.1_20, 5>);
  D.1744 ={v} {CLOBBER};
  __builtin_stack_restore (saved_stack.4_2);
  return D.1739_39;

}
...

[Bug tree-optimization/51990] ICE in copy_reference_ops_from_ref

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51990

--- Comment #1 from vries at gcc dot gnu.org 2012-01-25 08:39:23 UTC ---
tentative fix:

Index: gcc/tree-ssa-sccvn.c
===================================================================
--- gcc/tree-ssa-sccvn.c (revision 183325)
+++ gcc/tree-ssa-sccvn.c (working copy)
@@ -624,6 +624,10 @@ copy_reference_ops_from_ref (tree ref, V

       switch (temp.opcode)
     {
+    case WITH_SIZE_EXPR:
+      temp.op0 = TREE_OPERAND (ref, 1);
+      temp.off = 0;
+      break;
     case MEM_REF:
       /* The base address gets its own vn_reference_op_s structure.  */
       temp.op0 = TREE_OPERAND (ref, 1);
@@ -740,6 +744,7 @@ copy_reference_ops_from_ref (tree ref, V
       VEC_safe_push (vn_reference_op_s, heap, *result, &temp);

       if (REFERENCE_CLASS_P (ref)
+      || TREE_CODE (ref) == WITH_SIZE_EXPR
       || (TREE_CODE (ref) == ADDR_EXPR
           && !is_gimple_min_invariant (ref)))
     ref = TREE_OPERAND (ref, 0);

[Bug tree-optimization/51990] ICE in copy_reference_ops_from_ref

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51990

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |http://gcc.gnu.org/bugzilla
                   |                            |/show_bug.cgi?id=37428

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> 2012-01-25 08:49:28 UTC ---
This extension is not even documented, see PR 37428 for more info.  

I want to say this example is invalid as the function foo does not have enough
info about the size of struct s.

[Bug tree-optimization/51990] ICE in copy_reference_ops_from_ref

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51990

--- Comment #3 from vries at gcc dot gnu.org 2012-01-25 10:15:53 UTC ---
(In reply to comment #2)
> This extension is not even documented, see PR 37428 for more info.  
> 

There are at least these 3 examples in the testsuite that use this extension:
gcc.c-torture/compile/20030224-1.c
gcc.c-torture/execute/20020412-1.c
gcc.dg/lto/20090706-1_0.c

These 3 tests fail (in unmodified form) with my patch for PR51879 (see PR51879
comment 7) on this ICE.

> I want to say this example is invalid as the function foo does not have enough
> info about the size of struct s.

If the example is indeed valid, it would be nice if the compiler at least
warned about that.

Either way, the last 2 tests listed above use (int, ...) as prototype. IIUC,
using that prototype would remove your concern about invalidity. Using that
prototype instead, I get the same ICE:
...
int
zzz (char *s1, char *s2, int len, int *q)
{
  int z = 5;
  unsigned int i,  b;
  struct s { char a[z]; };
  struct s x; 

  extern int foo (int, ...) __attribute__((pure));

  for (i = 0; i < len; i++)
    s1[i] = s2[i];

  b = z & 0x3;

  len += (b == 0 ? 0 : 1) + z;

  *q = len;

  return foo (z, x, x);
}
...

I suppose another way to achieve the same is to use a nested function:
...
  __attribute__((pure,noinline)) int foo (struct s s1, struct s s2)
  {
    return 0;
  }
...

[Bug tree-optimization/51990] ICE in copy_reference_ops_from_ref

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51990

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2012-01-25
     Ever Confirmed|0                           |1

--- Comment #4 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-01-25 10:39:12 UTC ---
(In reply to comment #1)
> tentative fix:
> 
> Index: gcc/tree-ssa-sccvn.c
> ===================================================================
> --- gcc/tree-ssa-sccvn.c (revision 183325)
> +++ gcc/tree-ssa-sccvn.c (working copy)
> @@ -624,6 +624,10 @@ copy_reference_ops_from_ref (tree ref, V
> 
>        switch (temp.opcode)
>      {
> +    case WITH_SIZE_EXPR:
> +      temp.op0 = TREE_OPERAND (ref, 1);
> +      temp.off = 0;
> +      break;
>      case MEM_REF:
>        /* The base address gets its own vn_reference_op_s structure.  */
>        temp.op0 = TREE_OPERAND (ref, 1);
> @@ -740,6 +744,7 @@ copy_reference_ops_from_ref (tree ref, V
>        VEC_safe_push (vn_reference_op_s, heap, *result, &temp);
> 
>        if (REFERENCE_CLASS_P (ref)
> +      || TREE_CODE (ref) == WITH_SIZE_EXPR
>        || (TREE_CODE (ref) == ADDR_EXPR
>            && !is_gimple_min_invariant (ref)))
>      ref = TREE_OPERAND (ref, 0);

I think there are a lot of bugs lurking in the compiler with respect to
not handling WITH_SIZE_EXPR (which incidentially isn't a handled-component,
nor tcc_reference ...).  You btw. also need to handle re-materializing
them in create_component_ref_by_pieces_1.

[Bug tree-optimization/51990] ICE in copy_reference_ops_from_ref

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51990

vries at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |UNCONFIRMED
     Ever Confirmed|1                           |0

--- Comment #5 from vries at gcc dot gnu.org 2012-01-25 11:41:50 UTC ---
(In reply to comment #4)
> (In reply to comment #1)
> I think there are a lot of bugs lurking in the compiler with respect to
> not handling WITH_SIZE_EXPR (which incidentially isn't a handled-component,
> nor tcc_reference ...).  You btw. also need to handle re-materializing
> them in create_component_ref_by_pieces_1.

Indeed. Using the proposed patch and this example:
...
int y;
extern int foo (int, ...) __attribute__((pure));

int
zzz (char *s1, char *s2, int len, int *q, int c)
{
  int z = 5;
  unsigned int i,  b;
  struct s { char a[z]; };
  struct s x; 
  int y_tmp = 5;

  for (i = 0; i < len; i++)
    s1[i] = s2[i];

  b = z & 0x3;

  len += (b == 0 ? 0 : 1) + z;

  *q = len;

 if (c)
   y_tmp = foo (z, x, x) + 4;

 z = foo (z, x, x) + 4;
 y = y_tmp;

 return  z;
}
...

I hit this ICE:
...
test2.c: In function ‘zzz’:
test2.c:5:1: internal compiler error: in create_component_ref_by_pieces_1, at
tree-ssa-pre.c:2925
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.
...

tentative patch:
...
Index: tree-ssa-pre.c
===================================================================
--- tree-ssa-pre.c (revision 183325)
+++ tree-ssa-pre.c (working copy)
@@ -2780,6 +2780,7 @@ create_component_ref_by_pieces_1 (basic_
     case REALPART_EXPR:
     case IMAGPART_EXPR:
     case VIEW_CONVERT_EXPR:
+    case WITH_SIZE_EXPR:
       {
     tree folded;
     tree genop0 = create_component_ref_by_pieces_1 (block, ref,
@@ -2787,8 +2788,12 @@ create_component_ref_by_pieces_1 (basic_
                             stmts, domstmt);
     if (!genop0)
       return NULL_TREE;
-    folded = fold_build1 (currop->opcode, currop->type,
-                  genop0);
+
+    folded
+      = (currop->opcode == WITH_SIZE_EXPR
+         ? fold_build2 (currop->opcode, currop->type, genop0, currop->op0)
+         : fold_build1 (currop->opcode, currop->type, genop0));
+
     return folded;
       }
       break;
...

[Bug tree-optimization/51990] ICE in copy_reference_ops_from_ref

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51990

vries at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
         AssignedTo|unassigned at gcc dot       |vries at gcc dot gnu.org
                   |gnu.org                     |
     Ever Confirmed|0                           |1

[Bug tree-optimization/51990] ICE in copy_reference_ops_from_ref

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51990

--- Comment #6 from vries at gcc dot gnu.org 2012-01-27 10:38:32 UTC ---
Author: vries
Date: Fri Jan 27 10:38:27 2012
New Revision: 183614

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=183614
Log:
2012-01-27  Tom de Vries  <tom@codesourcery.com>

    PR tree-optimization/51990
    * tree-ssa-sccvn.c (copy_reference_ops_from_ref): Handle WITH_SIZE_EXPR.
    * tree-ssa-pre.c (create_component_ref_by_pieces_1): Same.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/tree-ssa-pre.c
    trunk/gcc/tree-ssa-sccvn.c

[Bug tree-optimization/51990] ICE in copy_reference_ops_from_ref

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51990

--- Comment #7 from vries at gcc dot gnu.org 2012-01-27 10:38:38 UTC ---
Author: vries
Date: Fri Jan 27 10:38:34 2012
New Revision: 183615

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=183615
Log:
2012-01-27  Tom de Vries  <tom@codesourcery.com>

    PR tree-optimization/51990
    * gcc.dg/pr51990.c: New test.
    * gcc.dg/pr51990-2.c: Same.

Added:
    trunk/gcc/testsuite/gcc.dg/pr51990-2.c
    trunk/gcc/testsuite/gcc.dg/pr51990.c
Modified:
    trunk/gcc/testsuite/ChangeLog

[Bug tree-optimization/51990] ICE in copy_reference_ops_from_ref

[vries at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51990

vries at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED
   Target Milestone|---                         |4.7.0

--- Comment #8 from vries at gcc dot gnu.org 2012-01-28 15:18:58 UTC ---
Patch and test-case committed, resolving to fixed.