[Bug tree-optimization/56321] New: ICE:segfault in midend for -funsafe-math-optimizations -O3

[Bug tree-optimization/56321] New: ICE:segfault in midend for -funsafe-math-optimizations -O3

[ktkachov at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

             Bug #: 56321
           Summary: ICE:segfault in midend for -funsafe-math-optimizations
                    -O3
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: ktkachov@gcc.gnu.org
                CC: jgreenhalgh@gcc.gnu.org, wschmidt@linux.vnet.ibm.com
            Target: arm-none-eabi, x86_64-unknown-linux-gnu


Created attachment 29449
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=29449
ICE triggers for -O3 -funsafe-math-optimizations

Attached test case triggers a segfault in the midend.

Observed on both arm-none-eabi and x86_64-unknown-linux-gnu

gcc -O3 -funsafe-math-optimizations test.c -S
test.c: In function ‘foo’:
test.c:1:7: internal compiler error: Segmentation fault
 float foo(int n)
       ^
0x8f4e45 crash_signal
    ../../gcc-fsf/gcc/toplev.c:332
0x84b7bc execute_function_todo
    ../../gcc-fsf/gcc/passes.c:1967
0x84da0d execute_todo
    ../../gcc-fsf/gcc/passes.c:1999
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.


Bisection showed r186567 introduced the problem.
It seems that the reassoc code tries to do something wrong with __builtin_pow*

[Bug tree-optimization/56321] ICE:segfault in midend for -funsafe-math-optimizations -O3

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-02-14
                 CC|                            |mpolacek at gcc dot gnu.org
      Known to work|                            |4.7.3
   Target Milestone|---                         |4.8.0
     Ever Confirmed|0                           |1
      Known to fail|                            |4.8.0

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-02-14 13:52:16 UTC ---
Confirmed.

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-02-14 13:58:06 UTC ---
Better backtrace:
X.c: In function ‘foo’:
X.c:1:7: internal compiler error: Segmentation fault
 float foo(int n)
       ^
0xa40775 crash_signal
    /home/marek/src/gcc/gcc/toplev.c:332
0xc058cb gimple_code
    /home/marek/src/gcc/gcc/gimple.h:1146
0xc06844 gimple_nop_p
    /home/marek/src/gcc/gcc/gimple.h:4872
0xc09498 verify_use
    /home/marek/src/gcc/gcc/tree-ssa.c:755
0xc09fa1 verify_ssa(bool)
    /home/marek/src/gcc/gcc/tree-ssa.c:1011
0x95e667 execute_function_todo
    /home/marek/src/gcc/gcc/passes.c:1967
0x95d991 do_per_function
    /home/marek/src/gcc/gcc/passes.c:1701
0x95e781 execute_todo
    /home/marek/src/gcc/gcc/passes.c:1999

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-02-14 14:06:36 UTC ---
And yeah, with -fno-tree-reassoc -> no ICE.

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[wschmidt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

William J. Schmidt <wschmidt at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |wschmidt at gcc dot gnu.org

--- Comment #4 from William J. Schmidt <wschmidt at gcc dot gnu.org> 2013-02-14 14:42:10 UTC ---
I'll have a look shortly.  I see it marked as a 4.8 regression even though this
work was done in 4.7.  Does the test pass on 4.7?

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[wschmidt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

--- Comment #5 from William J. Schmidt <wschmidt at gcc dot gnu.org> 2013-02-14 14:43:29 UTC ---
Actually I might be wrong about that, now that I think about it -- probably
this was done in 4.8.  It seems longer ago than that. ;)

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[wschmidt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

--- Comment #6 from William J. Schmidt <wschmidt at gcc dot gnu.org> 2013-02-14 20:11:32 UTC ---
Odd.  Reassociation makes a correct and profitable transformation into

foo (int n)
{
  double _2;
  double _5;
  double _6;
  double _7;
  double _8;
  float _9;

  <bb 2>:
  _2 = (double) n_1(D);
  _6 = _2 * 6.6666666666666662965923251249478198587894439697265625e-1;
  _7 = _6 + 2.0e+0;
  _5 = _7 * _2;
  _8 = _5;
  _9 = (float) _8;
  return _9;

}

but somehow verify_ssa() thinks the last statement (return _9;) contains a use
of the undefined SSA name _4.

Will continue to investigate later.

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[jsm28 at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

Joseph S. Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[wschmidt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

William J. Schmidt <wschmidt at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |wschmidt at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #7 from William J. Schmidt <wschmidt at gcc dot gnu.org> 2013-02-14 22:27:21 UTC ---
I see.  The problem is a memory VUSE on the return statement that no longer has
a def.  The VDEF was associated with the __builtin_pow statement that was
expanded.  Looks like I need to release the SSA name.  Working on a fix.

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> 2013-02-15 09:43:36 UTC ---
(In reply to comment #7)
> I see.  The problem is a memory VUSE on the return statement that no longer has
> a def.  The VDEF was associated with the __builtin_pow statement that was
> expanded.  Looks like I need to release the SSA name.  Working on a fix.

Use unlink_stmt_vdef when removing a stmt that possibly has a VDEF.

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[ktkachov at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

--- Comment #9 from ktkachov at gcc dot gnu.org 2013-02-15 11:08:38 UTC ---
Created attachment 29463
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=29463
Slightly modified testcase

This testcase is similar, but gives the error, I think it has the same cause,
might be helpful:
testcase.c: In function 'foo':
testcase.c:2:6: error: virtual use of statement not up-to-date
 void foo(int n, int nreps, float tdgefa, float tdgesl)
      ^
# .MEM_25 = VDEF <_7>
printf ("%f\n", _24);
testcase.c:2:6: internal compiler error: verify_ssa failed
0x844aec execute_function_todo
    /work/kyrtka01/local-checkouts/aarch32-trunk-testing/gcc/gcc/passes.c:1967
0x846d3d execute_todo
    /work/kyrtka01/local-checkouts/aarch32-trunk-testing/gcc/gcc/passes.c:1999

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[wschmidt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

--- Comment #10 from William J. Schmidt <wschmidt at gcc dot gnu.org> 2013-02-15 15:13:55 UTC ---
(In reply to comment #8)
> (In reply to comment #7)
> > I see.  The problem is a memory VUSE on the return statement that no longer has
> > a def.  The VDEF was associated with the __builtin_pow statement that was
> > expanded.  Looks like I need to release the SSA name.  Working on a fix.
> 
> Use unlink_stmt_vdef when removing a stmt that possibly has a VDEF.

Yes -- I've been trying that, but something more subtle seems to be going on. 
I think perhaps the statement isn't being removed but modified in place.  I've
been trying to unlink the VDEF when the call is known to go away later, and
that's not doing it either.  Going to have to get dirty with the debugger this
morning.

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[wschmidt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

--- Comment #11 from William J. Schmidt <wschmidt at gcc dot gnu.org> 2013-02-15 15:49:03 UTC ---
OK, got it.  I was on the right track, there were just several locations where
it could happen and I missed one.

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> 2013-02-18 12:11:59 UTC ---
Author: rguenth
Date: Mon Feb 18 12:11:47 2013
New Revision: 196117

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=196117
Log:
2013-02-18  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/56321
    * tree-ssa-reassoc.c (propagate_op_to_single_use): Properly
    order SSA name release and virtual operand unlinking.

    * gcc.dg/torture/pr56321.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr56321.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-reassoc.c

[Bug tree-optimization/56321] [4.8 Regression] ICE:segfault in midend for -funsafe-math-optimizations -O3

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56321

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #13 from Richard Biener <rguenth at gcc dot gnu.org> 2013-02-18 12:12:14 UTC ---
Fixed.