[Bug tree-optimization/52139] New: ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre --param case-values-threshold=1

[Bug tree-optimization/52139] New: ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre --param case-values-threshold=1

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

             Bug #: 52139
           Summary: ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC
                    -fno-tree-dominator-opts -fno-tree-fre --param
                    case-values-threshold=1
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: zsojka@seznam.cz
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu


Created attachment 26587
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26587
reduced testcase

Compiler output:
$ gcc -O -fPIC -fno-tree-dominator-opts -fno-tree-fre --param
case-values-threshold=1 testcase.c         
testcase.c: In function 'foo':
testcase.c:17:1: internal compiler error: in remove_insn, at emit-rtl.c:3960
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

(gdb) bt
#0  fancy_abort (file=0x1264468 "/mnt/svn/gcc-trunk/gcc/emit-rtl.c", line=3960,
function=0x1265661 "remove_insn")
    at /mnt/svn/gcc-trunk/gcc/diagnostic.c:898
#1  0x000000000073f55c in remove_insn (insn=0x7ffff5bc6580) at
/mnt/svn/gcc-trunk/gcc/emit-rtl.c:3960
#2  0x000000000069c541 in delete_insn (insn=0x7ffff5bc6580) at
/mnt/svn/gcc-trunk/gcc/cfgrtl.c:145
#3  0x000000000069fb8a in cfg_layout_merge_blocks (a=0x7ffff5ba5410,
b=0x7ffff5ba5340) at /mnt/svn/gcc-trunk/gcc/cfgrtl.c:2896
#4  0x000000000068c5f6 in merge_blocks (a=0x7ffff5ba5410, b=0x7ffff5ba5340) at
/mnt/svn/gcc-trunk/gcc/cfghooks.c:683
#5  0x00000000010810b7 in try_optimize_cfg (mode=<optimized out>) at
/mnt/svn/gcc-trunk/gcc/cfgcleanup.c:2696
#6  cleanup_cfg (mode=<optimized out>) at
/mnt/svn/gcc-trunk/gcc/cfgcleanup.c:2940
#7  0x00000000010d6cc6 in rest_of_handle_cse () at
/mnt/svn/gcc-trunk/gcc/cse.c:7327
#8  rest_of_handle_cse () at /mnt/svn/gcc-trunk/gcc/cse.c:7310
#9  0x00000000008fbba5 in execute_one_pass (pass=0x17ced80) at
/mnt/svn/gcc-trunk/gcc/passes.c:2081
#10 0x00000000008fbf65 in execute_pass_list (pass=0x17ced80) at
/mnt/svn/gcc-trunk/gcc/passes.c:2136
#11 0x00000000008fbf77 in execute_pass_list (pass=0x17c9f40) at
/mnt/svn/gcc-trunk/gcc/passes.c:2137
#12 0x0000000000a5e24e in tree_rest_of_compilation (fndecl=0x7ffff5ba6e00) at
/mnt/svn/gcc-trunk/gcc/tree-optimize.c:422
#13 0x00000000006affca in cgraph_expand_function (node=0x7ffff5a976c0) at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1829
#14 0x00000000006b1ebc in cgraph_expand_all_functions () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1896
#15 cgraph_optimize () at /mnt/svn/gcc-trunk/gcc/cgraphunit.c:2210
#16 0x00000000006b250a in cgraph_finalize_compilation_unit () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1338
#17 0x000000000058ec70 in c_write_global_declarations () at
/mnt/svn/gcc-trunk/gcc/c-decl.c:10030
#18 0x00000000009f0a2c in compile_file () at
/mnt/svn/gcc-trunk/gcc/toplev.c:573
#19 do_compile () at /mnt/svn/gcc-trunk/gcc/toplev.c:1938
#20 toplev_main (argc=18, argv=0x7fffffffd7f8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:2014
#21 0x00007ffff61cc09d in __libc_start_main () from /lib64/libc.so.6
#22 0x0000000000572371 in _start ()

Tested revisions:
r183913 - crash

[Bug rtl-optimization/52139] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre --param case-values-threshold=1

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

Zdenek Sojka <zsojka at seznam dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #26587|0                           |1
        is obsolete|                            |

--- Comment #1 from Zdenek Sojka <zsojka at seznam dot cz> 2012-02-06 19:55:30 UTC ---
Created attachment 26588
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26588
testcase failing in 4.5, 4.6 and 4.7

$ gcc -O -fPIC -fno-tree-dominator-opts -fno-tree-fre testcase2.c
testcase2.c: In function 'foo':
testcase2.c:44:1: internal compiler error: in remove_insn, at emit-rtl.c:3960
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

[Bug rtl-optimization/52139] [4.5/4.6/4.7 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2012-02-06
                 CC|                            |jakub at gcc dot gnu.org
         AssignedTo|unassigned at gcc dot       |jakub at gcc dot gnu.org
                   |gnu.org                     |
   Target Milestone|---                         |4.7.0
     Ever Confirmed|0                           |1

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-06 20:02:29 UTC ---
Started with http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=145494
Will have a look.

[Bug rtl-optimization/52139] [4.5/4.6/4.7 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-07 11:42:35 UTC ---
Created attachment 26602
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26602
gcc47-pr52139.patch

Ugh, this is ugly.  The main problem is that delete_insn/remove_insn refuse to
remove insns with NEXT_INSN (insn) == NULL_RTX (unless they are in the current
sequence or in the sequence stack).  Unfortunately in the cfglayout mode BB_END
or end of bb->il.rtl->{header,footer} often/always have it NULL.

In this testcase, we are merging two bbs where the first bb ends with an
unconditional jump to the second and second bb contains switch table followed
by barrier in its header, then deleted label, then NOTE_INSN_BASIC_BLOCK and
that is the last insn in that bb.  The first problem is that we
delete_insn_chain in the header just all but the last insn, so BB_END (a)
points to a BARRIER.  And the second problem is that when removing the
NOTE_INSN_BASIC_BLOCK note using delete_insn, NEXT_INSN (note) is NULL and thus
remove_insn ICEs.

The following ugly hacks fix it, but am not very happy about them.

[Bug rtl-optimization/52139] [4.5/4.6/4.7 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #26602|0                           |1
        is obsolete|                            |

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-07 12:20:19 UTC ---
Created attachment 26603
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26603
gcc47-pr52139.patch

Actually, the delete_insn_chain call removed the barrier, but as barriers don't
have BLOCK_FOR_INSN, it didn't update BB_END.

This is a different approach, which allows remove_insn to remove even the last
insn in a bb, if it is equal to BB_END.  And adjusts BB_END even if BB_END is a
BARRIER.  That part alternatively could be handled by forcibly setting BB_END
(a) = first; after the delete_insn_chain call for the header.
With the emit-rtl.c changes as is, the cfgrtl.c changes are just a cleanup to
merge two same code sequences, but if the second part of the emit-rtl.c change
is removed, we'd need to add that BB_END (a) = first;

[Bug rtl-optimization/52139] [4.5/4.6/4.7 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #26603|0                           |1
        is obsolete|                            |

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-07 13:22:45 UTC ---
Created attachment 26604
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26604
gcc47-pr52139.patch

That patch didn't get too far with rtl checking, we are sometimes remove_insn a
barrier after a barrier.

So, here is the variant with the second remove_insn change removed and instead
with BB_END (a) = first; in cfg_layout_merge_blocks.  Could add there
  gcc_checking_assert (BB_END (a) == first || BARRIER_P (BB_END (a)));
before that line if requested.

[Bug rtl-optimization/52139] [4.5/4.6/4.7 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
   Target Milestone|4.7.0                       |4.5.4

[Bug rtl-optimization/52139] [4.5/4.6/4.7 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-08 12:29:48 UTC ---
Author: jakub
Date: Wed Feb  8 12:29:43 2012
New Revision: 184005

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=184005
Log:
    PR rtl-optimization/52139
    * cfgrtl.c (cfg_layout_merge_blocks): If BB_END
    is a BARRIER after emit_insn_after_noloc, move BB_END
    to the last non-BARRIER insn before it.

    * gcc.dg/pr52139.c: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/pr52139.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/cfgrtl.c
    trunk/gcc/testsuite/ChangeLog

[Bug rtl-optimization/52139] [4.5/4.6 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-09 17:30:51 UTC ---
Author: jakub
Date: Thu Feb  9 17:30:39 2012
New Revision: 184062

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=184062
Log:
    Backported from mainline
    2012-02-08  Jakub Jelinek  <jakub@redhat.com>

    PR rtl-optimization/52139
    * cfgrtl.c (cfg_layout_merge_blocks): If BB_END
    is a BARRIER after emit_insn_after_noloc, move BB_END
    to the last non-BARRIER insn before it.

    * gcc.dg/pr52139.c: New test.

Added:
    branches/gcc-4_6-branch/gcc/testsuite/gcc.dg/pr52139.c
Modified:
    branches/gcc-4_6-branch/gcc/ChangeLog
    branches/gcc-4_6-branch/gcc/cfgrtl.c
    branches/gcc-4_6-branch/gcc/testsuite/ChangeLog

[Bug rtl-optimization/52139] [4.5 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-09 21:39:23 UTC ---
Author: jakub
Date: Thu Feb  9 21:39:20 2012
New Revision: 184074

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=184074
Log:
    Backported from mainline
    2012-02-08  Jakub Jelinek  <jakub@redhat.com>

    PR rtl-optimization/52139
    * cfgrtl.c (cfg_layout_merge_blocks): If BB_END
    is a BARRIER after emit_insn_after_noloc, move BB_END
    to the last non-BARRIER insn before it.

    * gcc.dg/pr52139.c: New test.

Added:
    branches/gcc-4_5-branch/gcc/testsuite/gcc.dg/pr52139.c
Modified:
    branches/gcc-4_5-branch/gcc/ChangeLog
    branches/gcc-4_5-branch/gcc/cfgrtl.c
    branches/gcc-4_5-branch/gcc/testsuite/ChangeLog

[Bug rtl-optimization/52139] [4.5 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-09 21:48:25 UTC ---
Fixed.

[Bug rtl-optimization/52139] [4.5 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |

--- Comment #10 from Steven Bosscher <steven at gcc dot gnu.org> 2013-04-11 19:23:01 UTC ---
The fix is wrong, if there is a jump table at the end of basic block a,
and a ends in a tablejump, then the blocks cannot be merged.  In the case
of this PR, the jump table must be dead and someone left it lingering.
The bug is the presence of a dead jump table, and the patch only papers
over the issue.

[Bug rtl-optimization/52139] [4.5 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

--- Comment #11 from Steven Bosscher <steven at gcc dot gnu.org> 2013-04-11 19:26:09 UTC ---
The proper fix is to simply prepend BB_HEADER_(b) to BB_FOOTER(b).  The
reason for linking BB_HEADER to BB_END(a) is that there used to be line
notes there:

  /* Possible line number notes should appear in between.  */

But that's ancient history.

On top of that, anything in BB_FOOTER(b) should *never* end up in the
insns chain, by definition of cfglayout's footers.

[Bug rtl-optimization/52139] [4.5 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |NEW
         AssignedTo|unassigned at gcc dot       |steven at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #12 from Steven Bosscher <steven at gcc dot gnu.org> 2013-04-13 14:58:53 UTC ---
Created attachment 29866
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=29866
Corrected fix

In cfglayout mode, header and footer insns should not be inserted in
the insn chain.

The real bug here turns out to be in cfg_layout_delete_block: It deletes
the basic block by re-attaching the header and footer to the insn chain
and uses rtl_delete_block to actually delete the basic block.  But at that
point, try_redirect_by_replacing_jump has already removed the tablejump
instruction, so get_last_bb_insn doesn't extend the basic block to include
the jump table data.  I will address that in a separate patch, but I'm not
sure yet how :-)

[Bug rtl-optimization/52139] [4.5 Regression] ICE: in remove_insn, at emit-rtl.c:3960 with -O -fPIC -fno-tree-dominator-opts -fno-tree-fre

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52139

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|steven at gcc dot gnu.org   |
         Resolution|                            |FIXED
   Target Milestone|4.5.4                       |4.9.0

--- Comment #13 from Steven Bosscher <steven at gcc dot gnu.org> 2013-04-16 20:15:41 UTC ---
Now properly fixed, xf. r197995