[Bug middle-end/54781] New: [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[Bug middle-end/54781] New: [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[Bernhard.Rosenkranzer at linaro dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54781

             Bug #: 54781
           Summary: [4.8 Regression] ICE in refs_may_alias_p_1, at
                    tree-ssa-alias.c:1124
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: Bernhard.Rosenkranzer@linaro.org


Created attachment 28328
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28328
Test case, not yet reduced

$ /opt/android-toolchain-trunk/bin/arm-linux-androideabi-g++ -c
-mfloat-abi=softfp -mfpu=neon  -O2 -o
out/target/product/maguro/obj/SHARED_LIBRARIES/libskia_intermediates/src/opts/SkBlitRow_opts_arm.o
SkBlitRow_opts_arm.i
external/skia/src/opts/SkBlitRow_opts_arm.cpp: In function 'void
S32A_D565_Opaque_Dither_neon(uint16_t*, const SkPMColor*, int, U8CPU, int,
int)':
external/skia/src/opts/SkBlitRow_opts_arm.cpp:1681:1: internal compiler error:
in refs_may_alias_p_1, at tree-ssa-alias.c:1124
 }
 ^
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

[Bug middle-end/54781] [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[Bernhard.Rosenkranzer at linaro dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54781

Bernhard Rosenkränzer <Bernhard.Rosenkranzer at linaro dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #28328|0                           |1
        is obsolete|                            |

--- Comment #1 from Bernhard Rosenkränzer <Bernhard.Rosenkranzer at linaro dot org> 2012-10-02 18:34:17 UTC ---
Created attachment 28329
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28329
(Mostly) reduced test case

[Bug middle-end/54781] [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[Bernhard.Rosenkranzer at linaro dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54781

--- Comment #2 from Bernhard Rosenkränzer <Bernhard.Rosenkranzer at linaro dot org> 2012-10-02 18:35:03 UTC ---
$ /opt/android-toolchain-trunk/bin/arm-linux-androideabi-g++ -c
-mfloat-abi=softfp -mfpu=neon  -O2 bug54781.c bug54781.c: In function 'void
bug54781(short unsigned int*, int, int)':
bug54781.c:75:1: internal compiler error: in refs_may_alias_p_1, at
tree-ssa-alias.c:1124
 }
 ^
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

[Bug target/54781] [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54781

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2012-11-20
                 CC|                            |jakub at gcc dot gnu.org,
                   |                            |ramana at gcc dot gnu.org
          Component|middle-end                  |target
   Target Milestone|---                         |4.8.0
     Ever Confirmed|0                           |1

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-11-20 13:50:08 UTC ---
Looks like a target bug to me, neon_dereference_pointer creates an invalid
MEM_REF (the first operand on it doesn't satisfy the required
is_gimple_mem_ref_addr predicate) and this invalid MEM_REF is then added by
expand_normal into the MEM_EXPR of the MEM, and the aliasing code is then upset
about it.

In particular, the MEM_REF operand is &z[x_5(D)].  The reason why &z[x_5(D)] is
in the CALL_EXPR_ARG of the builtin is expand_call_stmt optimization:
      /* TER addresses into arguments of builtin functions so we have a
         chance to infer more correct alignment information.  See PR39954.  */
Best would be if in this case the backend could find out the original argument,
which was a SSA_NAME, and use that as the MEM_REF operand instead, but I'm
afraid we don't have such a way right now.  So perhaps the backend could clear
MEM_EXPR
if it is invalid:
    case NEON_ARG_MEMORY:
...
      if (MEM_EXPR (op[argc]) && TREE_CODE (MEM_EXPR (op[argc])) == MEM_REF
          && !is_gimple_mem_ref_addr (TREE_OPERAND (MEM_EXPR (op[argc]), 0)))
        /* Make sure MEM_EXPR created by neon_dereference_pointer isn't
invalid.  */
        set_mem_expr (op[argc], NULL_RTX);

[Bug target/54781] [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54781

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |WAITING

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> 2012-12-07 11:43:36 UTC ---
Sounds more like a latent issue to me.  Yes, removing invalid MEM_EXPRs would
be ok - but where do we dispatch to the tree oracle by-passing ao_ref_from_mem
which should reject this as well?  Isn't this happening on the GIMPLE level?

[Bug target/54781] [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[Bernhard.Rosenkranzer at linaro dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54781

Bernhard Rosenkränzer <Bernhard.Rosenkranzer at linaro dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.7.3

--- Comment #5 from Bernhard Rosenkränzer <Bernhard.Rosenkranzer at linaro dot org> 2012-12-16 22:10:53 UTC ---
Still happens in current builds

[Bug target/54781] [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54781

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-12-17 11:25:53 UTC ---
(In reply to comment #4)
> Sounds more like a latent issue to me.  Yes, removing invalid MEM_EXPRs would
> be ok - but where do we dispatch to the tree oracle by-passing ao_ref_from_mem
> which should reject this as well?  Isn't this happening on the GIMPLE level?

It doesn't bypass ao_ref_from_mem, but that function doesn't reject it.
base in
282      base = ao_ref_base (ref);
is ARRAY_REF with first operand VAR_DECL (z) and second operand a SSA_NAME.
So, neither of the:
291      /* If this is a pointer dereference of a non-SSA_NAME punt.
292         ???  We could replace it with a pointer to anything.  */
293      if ((INDIRECT_REF_P (base)
294           || TREE_CODE (base) == MEM_REF)
295          && TREE_CODE (TREE_OPERAND (base, 0)) != SSA_NAME)
296        return false;
297      if (TREE_CODE (base) == TARGET_MEM_REF
298          && TMR_BASE (base)
299          && TREE_CODE (TMR_BASE (base)) != SSA_NAME)
300        return false;
tests actually result in return false.

[Bug target/54781] [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54781

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |ASSIGNED
         AssignedTo|unassigned at gcc dot       |rguenth at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> 2012-12-17 12:39:10 UTC ---
Ah, I'm testing the following, which seems to fix the testcase with a cross.

Index: alias.c
===================================================================
--- alias.c     (revision 194552)
+++ alias.c     (working copy)
@@ -283,20 +283,14 @@ ao_ref_from_mem (ao_ref *ref, const_rtx
   if (base == NULL_TREE)
     return false;

-  /* The tree oracle doesn't like to have these.  */
-  if (TREE_CODE (base) == FUNCTION_DECL
-      || TREE_CODE (base) == LABEL_DECL)
-    return false;
-
-  /* If this is a pointer dereference of a non-SSA_NAME punt.
-     ???  We could replace it with a pointer to anything.  */
-  if ((INDIRECT_REF_P (base)
-       || TREE_CODE (base) == MEM_REF)
-      && TREE_CODE (TREE_OPERAND (base, 0)) != SSA_NAME)
-    return false;
-  if (TREE_CODE (base) == TARGET_MEM_REF
-      && TMR_BASE (base)
-      && TREE_CODE (TMR_BASE (base)) != SSA_NAME)
+  /* The tree oracle doesn't like bases that are neither decls
+     nor indirect references of SSA names.  */
+  if (!DECL_P (base)
+      && (TREE_CODE (base) != MEM_REF
+         || TREE_CODE (TREE_OPERAND (base, 0)) != SSA_NAME)
+      && (TREE_CODE (base) != TARGET_MEM_REF
+         || (TMR_BASE (base)
+             && TREE_CODE (TMR_BASE (base)) != SSA_NAME)))
     return false;

   /* If this is a reference based on a partitioned decl replace the

[Bug target/54781] [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54781

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> 2012-12-17 14:55:59 UTC ---
Author: rguenth
Date: Mon Dec 17 14:55:53 2012
New Revision: 194554

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=194554
Log:
2012-12-17  Richard Biener  <rguenther@suse.de>

    PR middle-end/54781
    * alias.c (ao_ref_from_mem): More appropriately constrain the
    base object we feed to the tree oracle.  Remove dead code.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/alias.c

[Bug target/54781] [4.8 Regression] ICE in refs_may_alias_p_1, at tree-ssa-alias.c:1124

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54781

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> 2012-12-17 15:50:41 UTC ---
Fixed.