[Bug c++/58294] New: ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[Bug c++/58294] New: ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[dcb314 at hotmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

            Bug ID: 58294
           Summary: ice in update_ssa_across_abnormal_edges, at
                    tree-inline.c:1892
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com

Created attachment 30739
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30739&action=edit
gzipped C++ source code

I just tried to compile package 0ad-0.0.13-8.fc20 with gcc 4.9 trunk
dated 20130901. It said

/usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp: In function
'Status png_decode(rpU8, size_t, Tex*)':
/usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:160:22:
internal compiler error: in update_ssa_across_abnormal_edges, at tre
e-inline.c:1892
             destroy();
                      ^
0xb61e7f update_ssa_across_abnormal_edges
    ../../src/trunk/gcc/tree-inline.c:1892
0xb61e7f copy_edges_for_bb
    ../../src/trunk/gcc/tree-inline.c:2002
0xb61e7f copy_cfg_body
    ../../src/trunk/gcc/tree-inline.c:2386
0xb61e7f copy_body
    ../../src/trunk/gcc/tree-inline.c:2595
0xb66acb expand_call_inline
    ../../src/trunk/gcc/tree-inline.c:4197
0xb66acb gimple_expand_calls_inline
    ../../src/trunk/gcc/tree-inline.c:4304
0xb66acb optimize_inline_calls(tree_node*)
    ../../src/trunk/gcc/tree-inline.c:4458
0xf83b2d inline_transform(cgraph_node*)
    ../../src/trunk/gcc/ipa-inline-transform.c:436
0xa55839 execute_one_ipa_transform_pass
    ../../src/trunk/gcc/passes.c:2039
0xa55839 execute_all_ipa_transforms()
    ../../src/trunk/gcc/passes.c:2079
0x7f0030 expand_function
    ../../src/trunk/gcc/cgraphunit.c:1683
0x7f200e expand_all_functions
    ../../src/trunk/gcc/cgraphunit.c:1795
0x7f200e compile()
    ../../src/trunk/gcc/cgraphunit.c:2132
0x7f25f9 finalize_compilation_unit()
    ../../src/trunk/gcc/cgraphunit.c:2209
0x5fe53d cp_write_global_declarations()
    ../../src/trunk/gcc/cp/decl2.c:4364
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

Preprocessed source code attached. Flag -O2 required.

[Bug c++/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-09-02
                 CC|                            |mpolacek at gcc dot gnu.org
      Known to work|                            |4.8.1
   Target Milestone|---                         |4.9.0
            Summary|ice in                      |[4.9 Regression] ice in
                   |update_ssa_across_abnormal_ |update_ssa_across_abnormal_
                   |edges, at                   |edges, at
                   |tree-inline.c:1892          |tree-inline.c:1892
     Ever confirmed|0                           |1
      Known to fail|                            |4.9.0

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Started with r202145.

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

Markus Trippelsdorf <markus at trippelsdorf dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |markus at trippelsdorf dot de

--- Comment #3 from Markus Trippelsdorf <markus at trippelsdorf dot de> ---
Reduced:

struct A {
  virtual ~A();
  virtual void m_fn1() { delete this; }
  void m_fn2() { m_fn1(); }
};

struct B {
  A *pi_;
  B() { pi_->m_fn2(); }
};
struct C {
  B pn;
};
void _setjmp();
int png_decode() {
  _setjmp();
  C a;
  return 0;
}

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[kcc at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

Kostya Serebryany <kcc at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kcc at gcc dot gnu.org

--- Comment #4 from Kostya Serebryany <kcc at gcc dot gnu.org> ---
we see this while building chromium

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |hubicka at gcc dot gnu.org

--- Comment #5 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
 Thanks,  I saw this problem too while compiling chromium but then it went away
and we didn't really managed to simplify it to a testcase.

The problem here is that there is PHI sitting on a EH receiver (from setjmp)
and we are inlining speculatively inlined call that may throw while original
call didn't. It seems to be bug that is there for years. I am not quite sure
what to do in this scenario sort of going out of SSA for this particular symbol
and back to SSA again (that probably would go with markin it for update) 

Curiously enough your patch does not contain any calls that ipa-devirt would
change.

I am looking into it

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Jan Hubicka from comment #5)
>  Thanks,  I saw this problem too while compiling chromium but then it went
> away and we didn't really managed to simplify it to a testcase.
> 
> The problem here is that there is PHI sitting on a EH receiver (from setjmp)
> and we are inlining speculatively inlined call that may throw while original
> call didn't. It seems to be bug that is there for years. I am not quite sure
> what to do in this scenario sort of going out of SSA for this particular
> symbol and back to SSA again (that probably would go with markin it for
> update) 
> 
> Curiously enough your patch does not contain any calls that ipa-devirt would
> change.
> 
> I am looking into it

The fix is to preserve this "nonthrowing".  That's how I made it work
for the abnormal edge case.  Thus, wrap it in a NOTHROW region?

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[hubicka at ucw dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #7 from Jan Hubicka <hubicka at ucw dot cz> ---
> The fix is to preserve this "nonthrowing".  That's how I made it work

Yes, this was my first tought, too.

> for the abnormal edge case.  Thus, wrap it in a NOTHROW region?

I think we would have to invent it, since we have only must_not_throw.
Let me analyze this a bit furhter.

Honza

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Jan Hubicka from comment #7)
> > The fix is to preserve this "nonthrowing".  That's how I made it work
> 
> Yes, this was my first tought, too.
> 
> > for the abnormal edge case.  Thus, wrap it in a NOTHROW region?
> 
> I think we would have to invent it, since we have only must_not_throw.
> Let me analyze this a bit furhter.

Well, must_not_throw would work, too.

Richard.

> Honza

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[hubicka at ucw dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #9 from Jan Hubicka <hubicka at ucw dot cz> ---
> Well, must_not_throw would work, too.
It will wind up in producing EH receiver with terminate, probably not what we
want.

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Jan Hubicka from comment #9)
> > Well, must_not_throw would work, too.
> It will wind up in producing EH receiver with terminate, probably not what
> we want.

I think it is.  Because if you have

 try
   {
   .....
 try 
  {
    bogously-nothrow-call ();
  }
 catch
  {
  }
   ...
   }
  catch
   {
     ... verify not from bogously-nothrow-call
    }

we'll optimize away the inner try/catch and get into the wrong handler
if we try to wire things up after inlining bogously-nothrow-call.

Better terminate if the region indeed did throw (usually it's just
not optimized good enough).

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[hubicka at ucw dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #11 from Jan Hubicka <hubicka at ucw dot cz> ---
> Better terminate if the region indeed did throw (usually it's just
> not optimized good enough).

I tihnk that is difference in between throw() and nothrow attribute.
The first produce must not throw region and has thus code size&runtime
overhead, nothrow should avoid that. (plus there is new standard way
of doing nothrow now, right?)

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #12 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Created attachment 30770
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30770&action=edit
proposed fix

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #13 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
The problem here is the abnormal edge of setjmp not being copied around by
gimple_ic.  This bug is there since earlytimes of tree-ssa ;)

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
The abnormal edges for setjmp were introduced just in 4.9, not in the early
times of tree-ssa.

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #15 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Your fault then.  I suppose one can reproduce same problem with non-local gotos
by inlining C++ function into one with nested function...

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #16 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
richi has introduced them, not me, but that is just a detail ;).

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

--- Comment #17 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Author: hubicka
Date: Mon Sep  9 12:09:50 2013
New Revision: 202389

URL: http://gcc.gnu.org/viewcvs?rev=202389&root=gcc&view=rev
Log:
    PR middle-end/58294
    * value-prof.c (gimple_ic): Copy also abnormal edges.
    * g++.dg/torture/PR58294.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/torture/PR58294.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/value-prof.c

[Bug tree-optimization/58294] [4.9 Regression] ice in update_ssa_across_abnormal_edges, at tree-inline.c:1892

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58294

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #18 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Fixed.