[Bug middle-end/55035] New: reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze)

[Bug middle-end/55035] New: reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze)

[amylaar at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

             Bug #: 55035
           Summary: reload1.c:3766:41: error: ‘orig_dup[0]’ may be used
                    uninitialized in this function (for fr30, microblaze)
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Keywords: build, diagnostic
          Severity: normal
          Priority: P3
         Component: middle-end
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: amylaar@gcc.gnu.org
            Blocks: 44756
            Target: fr30-elf, microblaze-elf, microblaze-linux


g++ -c   -g -O2 -DIN_GCC -DCROSS_DIRECTORY_STRUCTURE  -fno-exceptions -fno-rtti
-fasynchronous-unwind-tables -W -Wall -Wno-narrowing -Wwrite-strings
-Wcast-qual -Wmissing-format-attribute -pedantic -Wno-long-long
-Wno-variadic-macros -Wno-overlength-strings -Werror -fno-common 
-DHAVE_CONFIG_H -I. -I. -I../../../gcc/gcc -I../../../gcc/gcc/.
-I../../../gcc/gcc/../include -I../../../gcc/gcc/../libcpp/include 
-I../../../gcc/gcc/../libdecnumber -I../../../gcc/gcc/../libdecnumber/dpd
-I../libdecnumber -I../../../gcc/gcc/../libbacktrace   
../../../gcc/gcc/reload1.c -o reload1.o
../../../gcc/gcc/reload1.c: In function ‘void
calculate_elim_costs_all_insns()’:
../../../gcc/gcc/reload1.c:3766:41: error: ‘orig_dup[0]’ may be used
uninitialized in this function [-Werror=maybe-uninitialized]
     *recog_data.dup_loc[i] = orig_dup[i];
                                         ^
../../../gcc/gcc/reload1.c:3642:7: note: ‘orig_dup[0]’ was declared here
   rtx orig_dup[MAX_RECOG_OPERANDS];
       ^
cc1plus: all warnings being treated as errors
make[2]: *** [reload1.o] Error 1

[Bug middle-end/55035] reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze, moxie, rl78)

[hp at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

Hans-Peter Nilsson <hp at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|2013-02-27 00:00:00         |2014-07-27
     Ever confirmed|0                           |1
      Known to fail|                            |4.8.0, 4.9.1

--- Comment #1 from Hans-Peter Nilsson <hp at gcc dot gnu.org> ---
Also seen for gcc-4.9.1 ppc64-linux host (gcc110) same targets this far
(considering the PR author probably same script, config-list.mk; except with
ada removed).

[Bug middle-end/55035] reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze, moxie, rl78)

[hp at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

--- Comment #2 from Hans-Peter Nilsson <hp at gcc dot gnu.org> ---
(In reply to Hans-Peter Nilsson from comment #1)
> Also seen for gcc-4.9.1 ppc64-linux host (gcc110)

I.e. host gcc-4.9.1 on gcc110 compiling trunk r212879.

[Bug middle-end/55035] reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze, moxie, rl78)

[hp at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

Hans-Peter Nilsson <hp at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |4.10.0

--- Comment #3 from Hans-Peter Nilsson <hp at gcc dot gnu.org> ---
(In reply to Hans-Peter Nilsson from comment #2)
> I.e. host gcc-4.9.1 on gcc110 compiling trunk r212879.

Also seen with trunk r212879 compiling trunk r212879, so these poor targets
would have broken native builds.  Thankfully apparently none have self-hosted
systems at this time.

[Bug middle-end/55035] reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze, moxie, rl78)

[aldot at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

Bernhard Reutner-Fischer <aldot at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|2014-07-27 00:00:00         |2015-4-9
                 CC|                            |aldot at gcc dot gnu.org
      Known to fail|4.10.0                      |5.0

--- Comment #4 from Bernhard Reutner-Fischer <aldot at gcc dot gnu.org> ---
Reconfirmed.

Nowadays (trunk@221914) also breaks all-gcc for nios2-linux-gnu.
Reminds me of bug #36550

Smallish testcase:

$ cat reload1.i ; echo EOF
/* PR target/55035 */
/* { dg-do compile } */
/* { dg-options "-O2 -W -Wall -Werror" } */
struct rtx_def;
typedef struct rtx_def *rtx;
enum rtx_code {
  UNKNOWN,
  INSN, 
  ASM_INPUT,
  CLOBBER
};
struct rtx_def {
  enum rtx_code code: 4;
};
class rtx_def;
class rtx_insn : public rtx_def {};
struct recog_data_d
{
  rtx operand[30];
  rtx *operand_loc[30];
  rtx *dup_loc[1];
  char dup_num[1];
  char n_operands;
  char n_dups;
};
extern struct recog_data_d recog_data;
extern int get_int(void);
void
elimination_costs_in_insn (rtx_insn *insn)
{
  int icode = get_int ();
  int i;
  rtx orig_operand[30];
  rtx orig_dup[30];
  if (icode < 0)
    {
      if (((enum rtx_code) insn->code) == INSN)
        __builtin_abort();
      return;
    }
  for (i = 0; i < recog_data.n_dups; i++)
    orig_dup[i] = *recog_data.dup_loc[i];
  for (i = 0; i < recog_data.n_operands; i++)
    {
      orig_operand[i] = recog_data.operand[i];
      if (orig_operand[i]->code == CLOBBER)
        *recog_data.operand_loc[i] = 0;
    }
  for (i = 0; i < recog_data.n_dups; i++)
    *recog_data.dup_loc[i]
      = *recog_data.operand_loc[(int) recog_data.dup_num[i]];
  for (i = 0; i < recog_data.n_dups; i++)
    *recog_data.dup_loc[i] = orig_dup[i];
}
EOF

$ g++ -O2 -W -Wall -Werror -c reload1.i -o reload1.o
reload1.i: In function ‘void elimination_costs_in_insn(rtx_insn*)’:
reload1.i:53:41: error: ‘orig_dup[0]’ may be used uninitialized in this
function [-Werror=maybe-uninitialized]
     *recog_data.dup_loc[i] = orig_dup[i];
                                         ^
cc1plus: all warnings being treated as errors
>From gcc-bugs-return-483196-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Apr 09 19:38:33 2015
Return-Path: <gcc-bugs-return-483196-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 33611 invoked by alias); 9 Apr 2015 19:38:33 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 33564 invoked by uid 55); 9 Apr 2015 19:38:29 -0000
From: "pault at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug fortran/56852] [4.8/4.9/5 Regression] ICE on invalid: "Bad array reference" for an undeclared loop variable
Date: Thu, 09 Apr 2015 19:38:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: fortran
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords: error-recovery, ice-on-invalid-code, patch
X-Bugzilla-Severity: minor
X-Bugzilla-Who: pault at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P4
X-Bugzilla-Assigned-To: pault at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.8.5
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-56852-4-lLumfdTGJK@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-56852-4@http.gcc.gnu.org/bugzilla/>
References: <bug-56852-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-04/txt/msg00748.txt.bz2
Content-length: 721

https://gcc.gnu.org/bugzilla/show_bug.cgi?idV852

--- Comment #8 from Paul Thomas <pault at gcc dot gnu.org> ---
Author: pault
Date: Thu Apr  9 19:37:57 2015
New Revision: 221955

URL: https://gcc.gnu.org/viewcvs?rev"1955&root=gcc&view=rev
Log:
2013-04-09  Paul Thomas  <pault@gcc.gnu.org>

    PR fortran/56852
    * primary.c (gfc_variable_attr): Avoid ICE on AR_UNKNOWN if any
    of the index variables are untyped and errors are present.

2013-04-09  Paul Thomas  <pault@gcc.gnu.org>

    PR fortran/56852
    * gfortran.dg/pr56852.f90 : New test

Added:
    trunk/gcc/testsuite/gfortran.dg/pr56852.f90
Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/primary.c
    trunk/gcc/testsuite/ChangeLog

[Bug middle-end/55035] reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze, moxie, rl78)

[miyuki at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

Mikhail Maltsev <miyuki at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|2015-04-09 00:00:00         |2015-5-20
                 CC|                            |miyuki at gcc dot gnu.org
      Known to fail|                            |6.0

--- Comment #5 from Mikhail Maltsev <miyuki at gcc dot gnu.org> ---
Reduced testcase:

$ cat ./warn2.cc
int arr[1];
int N;

void bar();

void foo()
{
  int temp[2];
  for (int i = 0; i < N; i++)
    temp[i] = arr[i];
  bar();
  for (int i = 0; i < N; i++)
    arr[i] = temp[i];
}


$ /opt/gcc-6.0.0/bin/g++ -c -Wall -O2 -fdump-tree-all ./warn2.cc
./warn2.cc: In function 'void foo()':
./warn2.cc:13:21: warning: 'temp[0]' may be used uninitialized in this function
[-Wmaybe-uninitialized]
     arr[i] = temp[i];

$ /opt/gcc-6.0.0/bin/g++ -c -Wall -O2 -fno-tree-sra ./warn2.cc
(no warning)

GCC performs scalar replacement of "temp" and unrolls both loops. N is global
and can be modified by bar(). The final GIMPLE looks like this:

$ cat ./warn2.cc.190t.optimized

void foo() ()
{
  int temp$0;
  int N.0_18;
  int N.0_24;

  <bb 2>:
  N.0_24 = N;
  if (N.0_24 <= 0)
    goto <bb 4>;
  else
    goto <bb 3>;

  <bb 3>:
  temp$0_25 = arr[0];

  <bb 4>:
  # temp$0_26 = PHI <temp$0_25(3), temp$0_27(D)(2)>
  bar ();
  N.0_18 = N;
  if (N.0_18 <= 0)
    goto <bb 6>;
  else
    goto <bb 5>;

  <bb 5>:
  arr[0] = temp$0_26;

  <bb 6>:
  return;
}

Here temp$0_27(D)(2) is the "uninitialized" case. In the original testcase
recog_data.n_dups is considered escaped and orig_dup[0] is treated the same way
as temp[0].

[Bug middle-end/55035] reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze, moxie, rl78)

[miyuki at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

--- Comment #7 from Mikhail Maltsev <miyuki at gcc dot gnu.org> ---
(quote from the mentioned discussion):
> We then have the call to bar() which could change the value of N to 1. We then hit the second loop and read temp[0] which is uninitialized. The warning for the reduced testcase is correct.

Oops, I thought that GCC is more conservative here. Then, indeed, the reduction
is invalid. Here is another attempt (tested against trunk revision r226223 and
this time it does not contain any calls, but I'm still not sure, whether it's
correct):

typedef struct rtx_def *rtx;
struct recog_data_d
{
  rtx operand;
  char n_dups;
};

rtx *operand_loc;
rtx dup_loc;

struct recog_data_d recog_data;

void elimination_costs_in_insn ()
{
  rtx orig_dup;
  if (recog_data.n_dups)
      orig_dup = dup_loc;
  *operand_loc = 0;
  if (recog_data.n_dups)
      dup_loc = orig_dup;
}

A warning is issued even at -O1. If I remove "rtx operand" field from struct
recog_data_d (or if I change the type of n_dups to int), then it disappears at
-O2 (but still present at -O1).

[Bug middle-end/55035] reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze, moxie, rl78)

[law at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

--- Comment #8 from Jeffrey A. Law <law at redhat dot com> ---
There are cases where the compiler can look into the implementation of bar()
and make better decisions about how memory objects may be effected.  This isn't
one of them ;-)

[Bug middle-end/55035] reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze, moxie, rl78)

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

--- Comment #9 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Author: rsandifo
Date: Thu Aug 13 20:22:34 2015
New Revision: 226874

URL: https://gcc.gnu.org/viewcvs?rev=226874&root=gcc&view=rev
Log:
gcc/
        PR bootstrap/55035
        * reload1.c (elimination_costs_in_insn): Make it obvious to the
        compiler that the n_dups and n_operands loop bounds are invariant.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/reload1.c

[Bug middle-end/55035] reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze, moxie, rl78)

[ro at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

Rainer Orth <ro at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|cr16-elf,fr30-elf,lm32-elf, |cr16-elf,fr30-elf,lm32-elf,
                   |lm32-rtems,lm32-uclinux,mic |lm32-rtems,lm32-uclinux,mic
                   |roblaze-elf,microblaze-linu |roblaze-elf,microblaze-linu
                   |x,moxie-elf,moxie-rtems,mox |x,moxie-elf,moxie-rtems,mox
                   |ie-uclinux,nios2-elf,nios2- |ie-uclinux,nios2-elf,nios2-
                   |linux-gnu,nios2-rtems,rl78- |linux-gnu,nios2-rtems,rl78-
                   |elf                         |elf,sparcv9-sun-solaris2*
             Status|RESOLVED                    |REOPENED
                 CC|                            |ro at gcc dot gnu.org
         Resolution|FIXED                       |---

--- Comment #11 from Rainer Orth <ro at gcc dot gnu.org> ---
As already mentioned on gcc-patches, the patch broke sparcv9-sun-solaris2.*
bootstrap (unlike sparc-sun-solaris2.*, which is still fine):

/vol/gcc/src/hg/trunk/local/gcc/reload1.c: In function 'void
elimination_costs_in_insn(rtx_insn*)':
/vol/gcc/src/hg/trunk/local/gcc/reload1.c:3772:41: error: 'orig_dup[1]' may be
used uninitialized in this function [-Werror=maybe-uninitialized]
     *recog_data.dup_loc[i] = orig_dup[i];
                                         ^
/vol/gcc/src/hg/trunk/local/gcc/reload1.c:3772:41: error: 'orig_dup[0]' may be
used uninitialized in this function [-Werror=maybe-uninitialized]

  Rainer

[Bug middle-end/55035] reload1.c:3766:41: error: ‘orig_dup[0]’ may be used uninitialized in this function (for fr30, microblaze, moxie, rl78)

[hp at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55035

Hans-Peter Nilsson <hp at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mikpelinux at gmail dot com

--- Comment #12 from Hans-Peter Nilsson <hp at gcc dot gnu.org> ---
*** Bug 67475 has been marked as a duplicate of this bug. ***