[Bug tree-optimization/56426] New: Segmentation fault in find_var_scev_info, at tree-scalar-evolution.c:358

[Bug tree-optimization/56426] New: Segmentation fault in find_var_scev_info, at tree-scalar-evolution.c:358

[antoine.balestrat at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56426

             Bug #: 56426
           Summary: Segmentation fault in find_var_scev_info, at
                    tree-scalar-evolution.c:358
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: antoine.balestrat@gmail.com


Using GCC 4.8.0 as of 20130222 :

$ cat scev.c
int a, *c;

void f(void)
{
    int b = 0;

    for(a = 0;; a++)
        if(--b)
        {
            if(a)
lbl:
                a++;

            c = &b;
            goto lbl;
        }
}

$ xgcc -w -O2 scev.c
scev.c: In function ‘f’:
scev.c:3:6: internal compiler error: Segmentation fault
 void f(void)
      ^
0x8f89ef crash_signal
    ../../srcdir/gcc/toplev.c:332
0xe1228f htab_find_slot
    ../../srcdir/libiberty/hashtab.c:712
0x98caf5 find_var_scev_info
    ../../srcdir/gcc/tree-scalar-evolution.c:358
0x98f999 get_scalar_evolution
    ../../srcdir/gcc/tree-scalar-evolution.c:559
0x98f999 analyze_scalar_evolution(loop*, tree_node*)
    ../../srcdir/gcc/tree-scalar-evolution.c:1963
0xa00287 infer_loop_bounds_from_signedness
    ../../srcdir/gcc/tree-ssa-loop-niter.c:2887
0xa00287 infer_loop_bounds_from_undefined
    ../../srcdir/gcc/tree-ssa-loop-niter.c:2944
0xa00287 estimate_numbers_of_iterations_loop
    ../../srcdir/gcc/tree-ssa-loop-niter.c:3340
0xa00287 estimate_numbers_of_iterations_loop(loop*)
    ../../srcdir/gcc/tree-ssa-loop-niter.c:3302
0xa015e4 estimate_numbers_of_iterations()
    ../../srcdir/gcc/tree-ssa-loop-niter.c:3534
0xa01aa7 tree_ssa_loop_bounds
    ../../srcdir/gcc/tree-ssa-loop.c:432
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

[Bug tree-optimization/56426] [4.8 Regression] Segmentation fault in find_var_scev_info, at tree-scalar-evolution.c:358

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56426

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-02-22
                 CC|                            |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |4.8.0
            Summary|Segmentation fault in       |[4.8 Regression]
                   |find_var_scev_info, at      |Segmentation fault in
                   |tree-scalar-evolution.c:358 |find_var_scev_info, at
                   |                            |tree-scalar-evolution.c:358
     Ever Confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-02-22 15:49:02 UTC ---
Confirmed.  Started with
http://gcc.gnu.org/viewcvs?view=revision&revision=195879

[Bug tree-optimization/56426] [4.8 Regression] Segmentation fault in find_var_scev_info, at tree-scalar-evolution.c:358

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56426

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |rguenth at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> 2013-02-25 08:45:36 UTC ---
Mine.

[Bug tree-optimization/56426] [4.8 Regression] Segmentation fault in find_var_scev_info, at tree-scalar-evolution.c:358

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56426

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-02-25 10:58:12 UTC ---
(gdb) 
358      slot = htab_find_slot (scalar_evolution_info, &tmp, INSERT);
(gdb) p scalar_evolution_info
$1 = (htab_t) 0x0

[Bug tree-optimization/56426] [4.8 Regression] Segmentation fault in find_var_scev_info, at tree-scalar-evolution.c:358

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56426

--- Comment #4 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-02-25 12:15:05 UTC ---
Goes away with -fno-tree-pre.  The thing is, PRE calls scev_finalize.  But
before loop optimizing, especially estimate_numbers_of_iterations, which calls
estimate_numbers_of_iterations_loop, SCEV should be initialized.  Or at least
estimate_numbers_of_iterations_loop should be guarded by if (scev_initialized_p
()) as on other places.  SCEV is normally initialized in tree_ssa_loop_init,
but only if number_of_loops > 1.

  if (number_of_loops () <= 1)
    return 0;

  scev_initialize ();

Would it make sense to always initialize SCEV, i.e.:
--- gcc/tree-ssa-loop.c.mp      2013-02-25 13:06:47.212132327 +0100
+++ gcc/tree-ssa-loop.c 2013-02-25 13:06:50.148141586 +0100
@@ -70,10 +70,11 @@ tree_ssa_loop_init (void)
                       | LOOPS_HAVE_RECORDED_EXITS);
   rewrite_into_loop_closed_ssa (NULL, TODO_update_ssa);

+  scev_initialize ();
+
   if (number_of_loops () <= 1)
     return 0;

-  scev_initialize ();
   return 0;
 }
?

[Bug tree-optimization/56426] [4.8 Regression] Segmentation fault in find_var_scev_info, at tree-scalar-evolution.c:358

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56426

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> 2013-02-25 12:50:15 UTC ---
Lack of predicated value-numbering makes the IL such that copy-propagation
inside the loop pipeline makes the single loop reducible.  Thus we missed
scev_initialize.

[gives light to the fact that our concept of 'loop pipeline' is somewhat
ill-defined]

[Bug tree-optimization/56426] [4.8 Regression] Segmentation fault in find_var_scev_info, at tree-scalar-evolution.c:358

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56426

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|rguenth at gcc dot gnu.org  |mpolacek at gcc dot gnu.org

--- Comment #6 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-02-25 14:06:29 UTC ---
Reassigning.

[Bug tree-optimization/56426] [4.8 Regression] Segmentation fault in find_var_scev_info, at tree-scalar-evolution.c:358

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56426

--- Comment #7 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-02-26 11:06:28 UTC ---
Author: mpolacek
Date: Tue Feb 26 11:06:14 2013
New Revision: 196281

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=196281
Log:
2013-02-26  Marek Polacek  <polacek@redhat.com>

        PR tree-optimization/56426
        * tree-ssa-loop.c (tree_ssa_loop_init): Always call
        scev_initialize.


Added:
    trunk/gcc/testsuite/gcc.dg/pr56436.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-loop.c

[Bug tree-optimization/56426] [4.8 Regression] Segmentation fault in find_var_scev_info, at tree-scalar-evolution.c:358

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56426

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #8 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-02-26 11:07:42 UTC ---
Fixed.