[Bug tree-optimization/54735] New: [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[Bug tree-optimization/54735] New: [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

             Bug #: 54735
           Summary: [4.8 Regression] Segmentation fault in
                    walk_aliased_vdefs_1
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: markus@trippelsdorf.de


The testcase from Bug 54146 segfaults on trunk (r191824):

% gdb g++
Reading symbols from /usr/bin/g++...(no debugging symbols found)...done.
(gdb) run slow.cc -c -w -O2
Starting program: /usr/bin/g++ slow.cc -frounding-math -c -w -O2
warning: no loadable sections found in added symbol-file system-supplied DSO at
0x7ffff7ffa000
process 2999 is executing new program:
/usr/x86_64-pc-linux-gnu/gcc-bin/4.8.0/g++
[New process 3002]
process 3002 is executing new program:
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.8.0/cc1plus

Program received signal SIGSEGV, Segmentation fault.
[Switching to process 3002]
0x00000000008c3b58 in walk_aliased_vdefs_1(ao_ref_s*, tree_node*, bool
(*)(ao_ref_s*, tree_node*, void*), void*, bitmap_head_def**, unsigned int)
[clone .constprop.15] ()
(gdb) bt
#0  0x00000000008c3b58 in walk_aliased_vdefs_1(ao_ref_s*, tree_node*, bool
(*)(ao_ref_s*, tree_node*, void*), void*, bitmap_head_def**, unsigned int)
[clone .constprop.15] ()
#1  0x00000000008c459e in walk_aliased_vdefs(ao_ref_s*, tree_node*, bool
(*)(ao_ref_s*, tree_node*, void*), void*, bitmap_head_def**) ()
#2  0x00000000008d0dee in propagate_necessity(edge_list*) () at
/home/markus/gcc/gcc/tree-ssa-dce.c:909
#3  0x00000000008d1da2 in perform_tree_ssa_dce(bool) () at
/home/markus/gcc/gcc/tree-ssa-dce.c:1584
#4  0x00000000007c86b2 in execute_one_pass(opt_pass*) () at
/home/markus/gcc/gcc/passes.c:2199
#5  0x00000000007c8a15 in execute_pass_list(opt_pass*) () at
/home/markus/gcc/gcc/passes.c:2254
#6  0x00000000007c8a27 in execute_pass_list(opt_pass*) () at
/home/markus/gcc/gcc/passes.c:2255
#7  0x000000000064f204 in expand_function(cgraph_node*) ()
#8  0x00000000006506ba in compile() ()
#9  0x0000000000650c25 in finalize_compilation_unit() ()
#10 0x00000000005290b7 in cp_write_global_declarations() () at
/home/markus/gcc/gcc/cp/decl2.c:4024
#11 0x0000000000858a05 in compile_file() ()
#12 0x000000000085a20a in toplev_main(int, char**) ()

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2012-09-28
         AssignedTo|unassigned at gcc dot       |rguenth at gcc dot gnu.org
                   |gnu.org                     |
   Target Milestone|---                         |4.8.0
     Ever Confirmed|0                           |1

--- Comment #1 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-09-28 13:07:58 UTC ---
Mine.

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

Markus Trippelsdorf <markus at trippelsdorf dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dehao at gcc dot gnu.org,
                   |                            |markus at trippelsdorf dot
                   |                            |de

--- Comment #2 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-09-28 19:29:48 UTC ---
Started with r191747:

commit bda16c7ca0bc1ec56857241a7313068f4824950f
Author: dehao <dehao@138bc75d-0d04-0410-961f-82ee72b054a4>
Date:   Tue Sep 25 21:32:29 2012 +0000

    libcpp:
        2012-09-25  Dehao Chen  <dehao@google.com>

        PR middle-end/54704
        * line-map.c (location_adhoc_data_hash): Fix the hash function.

Memory usage almost triples from 1GB to 3GB with this revisions
(after running for 2 minutes (then moment of the crash) on my CPU).

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[dehao at google dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

Dehao Chen <dehao at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dehao at google dot com

--- Comment #3 from Dehao Chen <dehao at google dot com> 2012-09-28 20:51:07 UTC ---
r191747 should not increase the memory consumption. Instead, it'll only speedup
compilation.

I tried to compile the testcase without the patch, the memory consumption still
increase, but very slowly (it took around 30 minutes to climb up to 1.8G)

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

--- Comment #4 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-09-28 20:55:22 UTC ---
(In reply to comment #3)
> r191747 should not increase the memory consumption. Instead, it'll only speedup
> compilation.
> 
> I tried to compile the testcase without the patch, the memory consumption still
> increase, but very slowly (it took around 30 minutes to climb up to 1.8G)

Yes, please ignore my bogus bisection. Sorry.

I will let the testcase run overnight with r191747 reverted and 
I guess it will also crash after a few hours.

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

Markus Trippelsdorf <markus at trippelsdorf dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #5 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-09-29 07:06:15 UTC ---
(In reply to comment #4)
> (In reply to comment #3)
> > r191747 should not increase the memory consumption. Instead, it'll only speedup
> > compilation.
> > 
> > I tried to compile the testcase without the patch, the memory consumption still
> > increase, but very slowly (it took around 30 minutes to climb up to 1.8G)
>
> I will let the testcase run overnight with r191747 reverted and 
> I guess it will also crash after a few hours.

It took roughly one hour to crash (amazing what an effect a single & can have).

The real culprit seems to be r190313:

commit a4f60e55a178cb5500186d27ff3fd4a62d0281e3
Author: jamborm <jamborm@138bc75d-0d04-0410-961f-82ee72b054a4>
Date:   Sat Aug 11 10:50:24 2012 +0000

    2012-08-11  Martin Jambor  <mjambor@suse.cz>

        PR fortran/48636
        * ipa-inline.h (condition): New fields offset, agg_contents and by_ref.
        * ipa-inline-analysis.c (agg_position_info): New type.
...

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

--- Comment #6 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-10-01 11:05:14 UTC ---
Hmhm, does it trigger with a reduced testcase also ...?

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

--- Comment #7 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-10-01 15:31:40 UTC ---
Created attachment 28314
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28314
testcase

(In reply to comment #6)
> Hmhm, does it trigger with a reduced testcase also ...?

Yes. It fails at -O2 only. If one initializes "Index a" the crash vanishes.


markus@x4 /tmp % cat test.ii
class Gmpfr
{};
class M : Gmpfr
{
public:
  Gmpfr infconst;
  M(int);
};
template<typename>struct A;
template<typename, int, int, int = 0 ? : 0, int = 0, int = 0>class N;
template<typename>class O;
template<typename>struct B;
struct C
{
  enum
  { value };
};
class D
{
public:
  enum
  { ret };
};
struct F
{
  enum
  { ret = 0 ? : 0 };
};
template<typename Derived>struct G
{
  typedef O<Derived>type;
};
struct H
{
  void operator * ();
};
struct I
{
  enum
  { RequireInitialization = C::value ? : 0, ReadCost };
};
template<typename Derived>struct J
{
  enum
  { ret = A<Derived>::InnerStrideAtCompileTime };
};
template<typename Derived>struct K
{
  enum
  { ret = A<Derived>::OuterStrideAtCompileTime };
};
template<typename Derived>class P : H
{
public:
  using H::operator *;
  typedef typename A<Derived>::Scalar Scalar;
  enum
  { RowsAtCompileTime                                        =
      A<Derived>::RowsAtCompileTime, ColsAtCompileTime       =
      A<Derived>::ColsAtCompileTime, SizeAtCompileTime       =
      F::ret, MaxRowsAtCompileTime                           =
      A<Derived>::MaxRowsAtCompileTime, MaxColsAtCompileTime =
      A<Derived>::MaxColsAtCompileTime, MaxSizeAtCompileTime =
      F::ret, Flags                                          =
      A<Derived>::Flags ? : 0 ? : 0, CoeffReadCost           =
      A<Derived>::CoeffReadCost, InnerStrideAtCompileTime    =
      J<Derived>::ret, OuterStrideAtCompileTime              = K<Derived>::ret
};
  B<Derived> operator << (const Scalar&);
};

template<typename Derived>class O : public P<Derived>
{};

template<int _Cols>class L
{
public:

  int cols()
  {
    return _Cols;
  }
};
template<typename Derived>class Q : public G<Derived>::type
{
public:
  typedef typename G<Derived>::type   Base;
  typedef typename A<Derived>::Index  Index;
  typedef typename A<Derived>::Scalar Scalar;
  L<Base::ColsAtCompileTime> m_storage;
  Index cols()
  {
    return m_storage.cols();
  }

  Scalar& coeffRef(Index,
                   Index);
};

template<typename _Scalar, int _Rows, int _Cols, int _Options, int _MaxRows,
         int _MaxCols>struct A<N<_Scalar, _Rows, _Cols, _Options, _MaxRows,
                                 _MaxCols> >
{
  typedef _Scalar Scalar;
  typedef int     Index;
  enum
  { RowsAtCompileTime, ColsAtCompileTime                              =
      _Cols, MaxRowsAtCompileTime, MaxColsAtCompileTime, Flags        =
      D::ret, CoeffReadCost                                           =
      I::ReadCost, InnerStrideAtCompileTime, OuterStrideAtCompileTime =
      0 ? : 0 };
};
template<typename _Scalar, int, int _Cols, int, int,
         int>class N : public Q<N<_Scalar, 0, _Cols> >
{
public:
  Q<N> Base;
  template<typename T0, typename T1>N(const T0&,
                                      const T1&);
};
void
__assert_fail(int)
throw() __attribute__((__noreturn__));
template<typename XprType>struct B
{
  typedef typename XprType::Scalar Scalar;
  typedef typename XprType::Index  Index;
  B(XprType & p1, const Scalar &) : m_xpr(p1), m_col(),
                                    m_currentBlockRows(1)
  {} B& operator, (const Scalar&)
  {
    Index a;

    if (m_col == m_xpr.cols())
    {
      m_col              = 0;
      m_currentBlockRows = 1;
      a && "Too       " ? static_cast<void>(0) : __assert_fail(0);
    }
    m_col < m_xpr.cols()
    && "Too       " ? static_cast<void>(0) : __assert_fail(1);
    m_currentBlockRows ? static_cast<void>(0) : __assert_fail(4);
    m_xpr.coeffRef(0, m_col++) = 0;
    return *this;
  }
  ~B()
  {
    1 + m_currentBlockRows && m_col
    && "Too       " ? static_cast<void>(0) : __assert_fail(0);
  }

  XprType& m_xpr;
  Index    m_col;
  Index    m_currentBlockRows;
};

template<typename Derived>B<Derived>P<
  Derived >::operator << (const Scalar&)
{
    return B<Derived>(*static_cast<Derived *>(this), 0);
}

template<class NT, int s>void
               check_()
{
    N<NT, 0, s>m(0, 0);
    m << 0, 0, 0, 0;
}

template<class NT>void check()
{
    check_<NT, 3>();
}

int main()
{
    check<M>();
}

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

--- Comment #8 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-10-02 10:37:08 UTC ---
It seems that SSA form is not up-to-date:

> ./cc1plus  -quiet t.ii -O2
t.ii: In function 'void check_() [with NT = M; int s = 3]':
t.ii:163:16: error: no immediate_use list
                check_()
                ^
for SSA_NAME: .MEM_62 in statement:
# VUSE <.MEM_62>
__assert_fail (0);
t.ii:163:16: internal compiler error: verify_ssa failed

which is after PRE.  So it might be the reduced testcase is not
triggering the same bug as the original one.

Tackling the PRE bug now (thus, -fno-tree-pre fixes it).

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tom at codesourcery dot com

--- Comment #9 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-10-02 11:17:08 UTC ---
Actually it's tail-merge.  Thus, -fno-tree-tail-merge fixes it as well.  We
enter update-ssa with

  <bb 9>:
  # .MEM_62 = VDEF <.MEM_60>
  D.2632.m_col = 0;
  if (a_32(D) == 0)
    goto <bb 10>;
  else
    goto <bb 34>;
...

  <bb 10>:
  # VUSE <.MEM_62>
  __assert_fail (0);
...

  <bb 18>:
  # .MEM_69 = VDEF <.MEM_67>
  D.2632.m_col = 0;
  # .MEM_70 = VDEF <.MEM_69>
  D.2632.m_currentBlockRows = 1;
  if (a_39(D) == 0)
    goto <bb 10>;
  else
    goto <bb 38>;

thus the .MEM_64 use is not dominated by its definition.  That's an
expected result from running tail-merge and is supposed to be fixed
by inserting a PHI node in bb 10 - and it does that.

What's the case is that:

static inline void
maybe_replace_use (use_operand_p use_p)
{
  tree rdef = NULL_TREE;
  tree use = USE_FROM_PTR (use_p);
  tree sym = DECL_P (use) ? use : SSA_NAME_VAR (use);

  if (marked_for_renaming (sym))
    rdef = get_reaching_def (sym);
  else if (is_old_name (use))
    rdef = get_reaching_def (use);

  if (rdef && rdef != use)
    SET_USE (use_p, rdef);
}

"optimizes" the rdef == use case but the reaching definition now is

  <bb 8>:
  # .MEM_62 = PHI <.MEM_74(23), .MEM_70(15), .MEM_74(22)>
  # VUSE <.MEM_62>
  __assert_fail (0);

and the use operand still has the old value (full SSA rewrite doesn't
require us to substitute .MEM everywhere).  But it isn't in the immediate
use list because the name got just re-defined.

Patch:

Index: gcc/tree-into-ssa.c
===================================================================
--- gcc/tree-into-ssa.c (revision 191969)
+++ gcc/tree-into-ssa.c (working copy)
@@ -1770,12 +1770,20 @@ maybe_replace_use (use_operand_p use_p)
   tree sym = DECL_P (use) ? use : SSA_NAME_VAR (use);

   if (marked_for_renaming (sym))
-    rdef = get_reaching_def (sym);
+    {
+      rdef = get_reaching_def (sym);
+      /* The operand slot may still contain an SSA name but it will
+         be not in the immediate use list as all SSA names were
+        re-defined.  Do not shortcut the rdef == use case.  */
+      if (rdef)
+       SET_USE (use_p, rdef);
+    }
   else if (is_old_name (use))
-    rdef = get_reaching_def (use);
-
-  if (rdef && rdef != use)
-    SET_USE (use_p, rdef);
+    {
+      rdef = get_reaching_def (use);
+      if (rdef && rdef != use)
+       SET_USE (use_p, rdef);
+    }
 }

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

--- Comment #10 from Martin Jambor <jamborm at gcc dot gnu.org> 2012-10-02 11:58:58 UTC ---
I get the SSA verification failure even on the PR 54146 testcase (as opposed to
the reduced one).  Please re-assign to me if fixing that will cause the
originally reported segfault to reemerge.  Thanks.

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

--- Comment #11 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-10-02 12:08:09 UTC ---
It's the same bug. The only difference is that I use --enable-checking=release.

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

--- Comment #12 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-10-02 13:03:07 UTC ---
Actually that just papers over the real issue.  The issue is that
cfg-cleanup runs before update-ssa and that removes a basic-block (9)
because we have

<bb 8>:
D.2778 ={v} {CLOBBER};
if (1 == 0)
  goto <bb 9>;
else
  goto <bb 33>;

  <bb 9>:
  # .MEM_62 = VDEF <.MEM_60>
  D.2632.m_col = 0;

  <bb 10>:
  # VUSE <.MEM_62>
  __assert_fail (0);

but as you can see this removes the definition for .MEM_62!

That is what confuses update-SSA (rightfully so - it re-assigns .MEM_62
to the inserted PHI node).

Which means we need to update virtual SSA form right here, before
calling cfgcleanup.

[Bug tree-optimization/54735] [4.8 Regression] Segmentation fault in walk_aliased_vdefs_1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

--- Comment #13 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-10-04 11:48:31 UTC ---
Author: rguenth
Date: Thu Oct  4 11:48:21 2012
New Revision: 192078

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=192078
Log:
2012-10-04  Richard Guenther  <rguenther@suse.de>

    PR middle-end/54735
    * tree-ssa-pre.c (do_pre): Make sure to update virtual SSA form before
    cleaning up the CFG.

    * g++.dg/torture/pr54735.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/torture/pr54735.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-pre.c

[Bug tree-optimization/54735] [4.7 Regression] Segmentation fault in walk_aliased_vdefs_1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.8.0
   Target Milestone|4.8.0                       |4.7.3
            Summary|[4.8 Regression]            |[4.7 Regression]
                   |Segmentation fault in       |Segmentation fault in
                   |walk_aliased_vdefs_1        |walk_aliased_vdefs_1

--- Comment #14 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-10-04 11:49:27 UTC ---
Fixed for trunk for now, latent on the branch.

[Bug tree-optimization/54735] [4.7 Regression] Segmentation fault in walk_aliased_vdefs_1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

--- Comment #15 from Richard Biener <rguenth at gcc dot gnu.org> 2012-11-26 14:26:18 UTC ---
Author: rguenth
Date: Mon Nov 26 14:26:07 2012
New Revision: 193816

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=193816
Log:
2012-11-26  Richard Biener  <rguenther@suse.de>

    Backport from mainline
    2012-10-19  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/54976
    * tree-vect-stmts.c (get_vectype_for_scalar_type_and_size):
    Robustify against odd inner_mode inputs.

    2012-10-12  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/54894
    * tree-vect-stmts.c (get_vectype_for_scalar_type_and_size):
    Handle over-aligned scalar types properly.

    2012-10-02  Richard Guenther  <rguenther@suse.de>

    PR middle-end/54735
    * tree-ssa-pre.c (do_pre): Make sure to update virtual SSA form before
    cleaning up the CFG.


    2012-10-12  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/54894
    * gcc.dg/torture/pr54894.c: New testcase.

    2012-10-02  Richard Guenther  <rguenther@suse.de>

    PR middle-end/54735
    * g++.dg/torture/pr54735.C: New testcase.

Added:
    branches/gcc-4_7-branch/gcc/testsuite/g++.dg/torture/pr54735.C
    branches/gcc-4_7-branch/gcc/testsuite/gcc.dg/torture/pr54894.c
Modified:
    branches/gcc-4_7-branch/gcc/ChangeLog
    branches/gcc-4_7-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_7-branch/gcc/tree-ssa-pre.c
    branches/gcc-4_7-branch/gcc/tree-vect-stmts.c

[Bug tree-optimization/54735] [4.7 Regression] Segmentation fault in walk_aliased_vdefs_1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54735

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #16 from Richard Biener <rguenth at gcc dot gnu.org> 2012-11-26 14:27:09 UTC ---
Fixed.