[Bug rtl-optimization/55270] New: ICE in get_loop_body, at cfgloop.c:823

[Bug rtl-optimization/55270] New: ICE in get_loop_body, at cfgloop.c:823

[antoine.balestrat at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

             Bug #: 55270
           Summary: ICE in get_loop_body, at cfgloop.c:823
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: antoine.balestrat@gmail.com


Hello ! The following testcase makes GCC 4.8.0 20121110 crash at -O3 :

$ cat loopbody.c
unsigned a, b, c;

void f(void)
{
    for(; a; a++)
    {
        // In 32 bits mode, you'll have to change p1 to "long long int" to
trigger the bug
        long *p1 = &b;

        if(*p1)
            return;

        if(b && (*p1 = b) || c && ++*p1)
        {
            unsigned *p2 = &b;

            for(*p2 = 0; *p2 < 1;)
                for(; b; b++);
        }
    }
}


$ xgcc -w -O3 loopbody.c
loopbody.c: In function ‘f’:
loopbody.c:3:6: internal compiler error: in get_loop_body, at cfgloop.c:823
 void f(void)
      ^
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

[Bug rtl-optimization/55270] ICE in get_loop_body, at cfgloop.c:823

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2012-11-13
                 CC|                            |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |4.8.0
     Ever Confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> 2012-11-13 10:20:43 UTC ---
Confirmed.

[Bug rtl-optimization/55270] ICE in get_loop_body, at cfgloop.c:823

[antoine.balestrat at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #2 from Antoine Balestrat <antoine.balestrat at gmail dot com> 2013-01-26 14:10:57 UTC ---
Still reproducible as of 4.8.0 20130125.

Started with http://gcc.gnu.org/viewcvs?view=revision&revision=185913

[Bug rtl-optimization/55270] ICE in get_loop_body, at cfgloop.c:823

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |mpolacek at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-01-26 14:27:56 UTC ---
Mine.

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #4 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-01-28 13:33:47 UTC ---
The problem here is in dfs_enumerate_from, which wrongly detects the number of
BBs in a loop.  get_loop_body_with_size calls dfs_enumerate_from with reverse =
1, thus we go against direction of edges.  I.e., we start at the header, then
go through its predecessors and if the predecessor hasn't been visited yet and
is dominated by the header, we count it.  But, we don't count BB which only has
an exit edge--thus its successor is outside of the loop.  Moving in !reverse
direction doesn't seem to help.  I'm not exactly sure what to do here, I'm
afraid of touching dfs_enumerate_from algorithm ;).

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #5 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-01-28 13:35:15 UTC ---
Maybe just remove the assert?  We know, that dfs_enumerate_from can sometimes
return bogus number.

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[rguenther at suse dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #6 from rguenther at suse dot de <rguenther at suse dot de> 2013-01-28 13:39:28 UTC ---
On Mon, 28 Jan 2013, mpolacek at gcc dot gnu.org wrote:

> 
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270
> 
> --- Comment #5 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-01-28 13:35:15 UTC ---
> Maybe just remove the assert?  We know, that dfs_enumerate_from can sometimes
> return bogus number.

Huh?  Definitely not ...

Let me have a look here.

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #7 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-01-28 13:42:51 UTC ---
Yeah, on the second thought, that is nonsense, sorry.

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> 2013-01-28 13:48:29 UTC ---
BB 12 does not belong to loop 1 but is marked so.  Broken by late phicprop.

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> 2013-01-28 14:03:18 UTC ---
When propagate_rhs_into_lhs alters the CFG from

   if ()
    {
     if ()
      exit_loop;
    }

to

   if ()
    {
      exit_loop;
    }

it fails to fixup loop structure:

          /* Propagation into these nodes may make certain edges in
             the CFG unexecutable.  We want to identify them as PHI nodes
             at the destination of those unexecutable edges may become
             degenerates.  */
          else if (gimple_code (use_stmt) == GIMPLE_COND
                   || gimple_code (use_stmt) == GIMPLE_SWITCH
                   || gimple_code (use_stmt) == GIMPLE_GOTO)
            {
...

Now, for full propagation the edge wants marking as non-executable
(which is done by removing it here - somewhat premature, as CFG cleanup
is run afterwards anyway and that handles the situation correctly
by calling fix_loop_structure).

Index: gcc/tree-ssa-dom.c
===================================================================
--- gcc/tree-ssa-dom.c  (revision 195502)
+++ gcc/tree-ssa-dom.c  (working copy)
@@ -3006,7 +3006,14 @@ eliminate_degenerate_phis (void)
     }

   if (cfg_altered)
-    free_dominance_info (CDI_DOMINATORS);
+    {
+      free_dominance_info (CDI_DOMINATORS);
+      if (current_loops)
+       {
+         calculate_dominance_info (CDI_DOMINATORS);
+         fix_loop_structure (NULL);
+       }
+    }

   /* Propagation of const and copies may make some EH edges dead.  Purge
      such edges from the CFG as needed.  */

fixes this (one more reason to fix loop structure at loop_optimizer_init
instead ...)

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #10 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-01-28 16:43:31 UTC ---
Unfortunately this patch causes a few FAILs, e.g.:

/home/polacek/src/gcc/gcc/testsuite/gcc.c-torture/compile/20020604-1.c: In
function ‘foo’:
/home/polacek/src/gcc/gcc/testsuite/gcc.c-torture/compile/20020604-1.c:15:1:
internal compiler error: in calc_dfs_tree, at dominance.c:397
 foo (unsigned int n, int x, int y, unsigned char *z)
 ^
0x63c87b calc_dfs_tree
    /home/polacek/src/gcc/gcc/dominance.c:397
0x63ca66 calculate_dominance_info(cdi_direction)
    /home/polacek/src/gcc/gcc/dominance.c:658
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

I can take a look (but probably only tomorrow).

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[rguenther at suse dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #11 from rguenther at suse dot de <rguenther at suse dot de> 2013-01-29 09:01:23 UTC ---
On Mon, 28 Jan 2013, mpolacek at gcc dot gnu.org wrote:

> 
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270
> 
> --- Comment #10 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-01-28 16:43:31 UTC ---
> Unfortunately this patch causes a few FAILs, e.g.:
> 
> /home/polacek/src/gcc/gcc/testsuite/gcc.c-torture/compile/20020604-1.c: In
> function ?foo?:
> /home/polacek/src/gcc/gcc/testsuite/gcc.c-torture/compile/20020604-1.c:15:1:
> internal compiler error: in calc_dfs_tree, at dominance.c:397
>  foo (unsigned int n, int x, int y, unsigned char *z)
>  ^
> 0x63c87b calc_dfs_tree
>     /home/polacek/src/gcc/gcc/dominance.c:397
> 0x63ca66 calculate_dominance_info(cdi_direction)
>     /home/polacek/src/gcc/gcc/dominance.c:658
> Please submit a full bug report,
> with preprocessed source if appropriate.
> Please include the complete backtrace with any bug report.
> See <http://gcc.gnu.org/bugs.html> for instructions.
> 
> I can take a look (but probably only tomorrow).

I'll test an alternative patch.

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #12 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-01-29 09:38:59 UTC ---
(In reply to comment #11)
> I'll test an alternative patch.

FYI, I've tried this one:
--- a/gcc/loop-init.c
+++ b/gcc/loop-init.c
@@ -57,6 +57,7 @@ loop_optimizer_init (unsigned flags)

       /* Ensure that the dominators are computed, like flow_loops_find does. 
*/
       calculate_dominance_info (CDI_DOMINATORS);
+      fix_loop_structure (NULL);

 #ifdef ENABLE_CHECKING
       verify_loop_structure ();

it cures this ICE, and was even successfully regtested.

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

--- Comment #13 from Richard Biener <rguenth at gcc dot gnu.org> 2013-01-29 10:40:29 UTC ---
Author: rguenth
Date: Tue Jan 29 10:40:24 2013
New Revision: 195533

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=195533
Log:
2013-01-29  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/55270
    * tree-ssa-dom.c (eliminate_degenerate_phis): If we changed
    the CFG, schedule loops for fixup.

    * gcc.dg/torture/pr55270.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr55270.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-dom.c

[Bug rtl-optimization/55270] [4.8 Regression] ICE in get_loop_body, at cfgloop.c:823

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55270

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #14 from Richard Biener <rguenth at gcc dot gnu.org> 2013-01-29 11:38:46 UTC ---
Fixed.