[Bug rtl-optimization/57662] New: [4.9 Regression] ICE: SIGSEGV in code_motion_process_successors with -fschedule-insns2 -fselective-scheduling2

[Bug rtl-optimization/57662] New: [4.9 Regression] ICE: SIGSEGV in code_motion_process_successors with -fschedule-insns2 -fselective-scheduling2

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57662

            Bug ID: 57662
           Summary: [4.9 Regression] ICE: SIGSEGV in
                    code_motion_process_successors with -fschedule-insns2
                    -fselective-scheduling2
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz

Created attachment 30327
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30327&action=edit
reduced testcase

Compiler output:
$ gcc -O -fno-guess-branch-probability -fpeel-loops
-freorder-blocks-and-partition -fschedule-insns2 -fsel-sched-pipelining
-fselective-scheduling2 -ftree-pre testcase.c
testcase.c: In function 'GetHangarNum':
testcase.c:44:1: internal compiler error: Segmentation fault
 }
 ^
0xa4ce7f crash_signal
        /mnt/svn/gcc-trunk/gcc/toplev.c:333
0xa100f9 code_motion_process_successors
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:6429
0xa100f9 code_motion_path_driver
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:6669
0xa13f87 move_op
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:6758
0xa13f87 move_exprs_to_boundary
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:5292
0xa13f87 schedule_expr_on_boundary
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:5504
0xa15e77 fill_insns
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:5646
0xa15e77 schedule_on_fences
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:7410
0xa15e77 sel_sched_region_2
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:7544
0xa19c44 sel_sched_region_1
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:7583
0xa19c44 sel_sched_region(int)
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:7684
0xa1b3b9 run_selective_scheduling()
        /mnt/svn/gcc-trunk/gcc/sel-sched.c:7760
0x9ec8b5 rest_of_handle_sched2
        /mnt/svn/gcc-trunk/gcc/sched-rgn.c:3606
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

$ gcc -v
Using built-in specs.
COLLECT_GCC=/mnt/svn/gcc-trunk/binary-latest/bin/gcc
COLLECT_LTO_WRAPPER=/mnt/svn/gcc-trunk/binary-200224-lto-fortran-checking-yes-rtl-df/libexec/gcc/x86_64-unknown-linux-gnu/4.9.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: /mnt/svn/gcc-trunk//configure --enable-checking=yes,rtl,df
--enable-languages=c,c++,lto,fortran
--prefix=/mnt/svn/gcc-trunk/binary-200224-lto-fortran-checking-yes-rtl-df/
--without-cloog --without-ppl
Thread model: posix
gcc version 4.9.0 20130619 (experimental) (GCC) 

Tested revisions:
r200224 - crash
4.8 r198018 - OK

[Bug rtl-optimization/57662] [4.9 Regression] ICE: SIGSEGV in code_motion_process_successors with -fschedule-insns2 -fselective-scheduling2

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57662

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.9.0

[Bug rtl-optimization/57662] [4.9 Regression] ICE: SIGSEGV in code_motion_process_successors with -fschedule-insns2 -fselective-scheduling2

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57662

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-07-24
                 CC|                            |mpolacek at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed.

[Bug rtl-optimization/57662] [4.9 Regression] ICE: SIGSEGV in code_motion_process_successors with -fschedule-insns2 -fselective-scheduling2

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57662

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
In sel-sched.c,
      /* We have simplified the control flow below this point.  In this case,
         the iterator becomes invalid.  We need to try again.  */
      if (BLOCK_FOR_INSN (insn)->index != old_index
          || EDGE_COUNT (bb->succs) != old_succs)
the BLOCK_FOR_INSN (insn) is NULL, so we segfault; the call to
code_motion_path_driver somehow changes the insn to
(jump_insn/v 203 0 0 (set (pc)
        (label_ref 202)) -1
     (nil)
 -> 202)

[Bug rtl-optimization/57662] [4.9 Regression] ICE: SIGSEGV in code_motion_process_successors with -fschedule-insns2 -fselective-scheduling2

[abel at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57662

Andrey Belevantsev <abel at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |abel at gcc dot gnu.org
           Assignee|unassigned at gcc dot gnu.org      |abel at gcc dot gnu.org

--- Comment #3 from Andrey Belevantsev <abel at gcc dot gnu.org> ---
I will take a look, but I will be on vacation in two days, so do not expect
much on this until September.

[Bug rtl-optimization/57662] [4.9 Regression] ICE: SIGSEGV in code_motion_process_successors with -fschedule-insns2 -fselective-scheduling2

[abel at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57662

--- Comment #4 from Andrey Belevantsev <abel at gcc dot gnu.org> ---
Created attachment 30650
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30650&action=edit
proposed patch

When moving up an instruction, we can make empty basic blocks or create other
possibilities for control flow simplification, thus we do it along the way. 
This means that while we are in the iterator over successor blocks, those
blocks could change, and we need to rescan successors to make sure we visit all
of them.  We do that with checking whether the number of successor blocks of
the visiting block changed or the visiting block index itself changed, and we
get hold of the visiting block via its last insn.

Now, the problem is that this last insn itself can be removed during
simplification.  I have convinced myself that only case when this might happen
is when the insn is an unconditional jump (the conditional jump might be
changed to unconditional but not removed altogether).  In this case we had a
single successor and we have already visited it, so we just break from the
successor iterator instead of attempting to rescan.

I will test the attached patch and submit if succesful.

[Bug rtl-optimization/57662] [4.9 Regression] ICE: SIGSEGV in code_motion_process_successors with -fschedule-insns2 -fselective-scheduling2

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57662

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed according to

2013-08-14  Andrey Belevantsev  <abel@ispras.ru>

        PR rtl-optimization/57662
        * sel-sched.c (code_motion_process_successors): When the current insn
        is removed after the recursive traversal, break from the loop.
        Add comments and debug printouts.

(?)

[Bug rtl-optimization/57662] [4.9 Regression] ICE: SIGSEGV in code_motion_process_successors with -fschedule-insns2 -fselective-scheduling2

[abel at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57662

--- Comment #6 from Andrey Belevantsev <abel at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #5)
> Fixed according to
> 
> 2013-08-14  Andrey Belevantsev  <abel@ispras.ru>
> 
>         PR rtl-optimization/57662
>         * sel-sched.c (code_motion_process_successors): When the current insn
>         is removed after the recursive traversal, break from the loop.
>         Add comments and debug printouts.
> 
> (?)

Yes.  Sorry, I keep forgetting that the post-commit Bugzilla autoupdate no
longer works so I didn't look at the PR after committing.

[Bug rtl-optimization/57662] [4.9 Regression] ICE: SIGSEGV in code_motion_process_successors with -fschedule-insns2 -fselective-scheduling2

[abel at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57662

--- Comment #7 from Andrey Belevantsev <abel at gcc dot gnu.org> ---
Author: abel
Date: Mon Feb  3 12:00:23 2014
New Revision: 207421

URL: http://gcc.gnu.org/viewcvs?rev=207421&root=gcc&view=rev
Log:
gcc/
    PR rtl-optimization/57662
    * sel-sched.c (code_motion_path_driver): Do not mark already not
    existing blocks in the visiting bitmap.

testsuite/
    PR rtl-optimization/57662
    * g++.dg/pr57662.C: New test.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/sel-sched.c
    trunk/gcc/testsuite/ChangeLog