[Bug tree-optimization/58326] New: ICE in check_loop_closed_ssa_use, at tree-ssa-loop-manip.c:551

[Bug tree-optimization/58326] New: ICE in check_loop_closed_ssa_use, at tree-ssa-loop-manip.c:551

[su at cs dot ucdavis.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58326

            Bug ID: 58326
           Summary: ICE in check_loop_closed_ssa_use, at
                    tree-ssa-loop-manip.c:551
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu

The following code causes an ICE when compiled with the current gcc trunk at
-O2 and -O3 on x86_64-linux (both 32-bit and 64-bit modes). 

This is a regression from 4.8.x.


$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.9.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure
--enable-languages=c,c++,objc,obj-c++,fortran,lto
--with-gmp=/usr/local/gcc-trunk --with-mpfr=/usr/local/gcc-trunk
--with-mpc=/usr/local/gcc-trunk --with-cloog=/usr/local/gcc-trunk
--prefix=/usr/local/gcc-trunk
Thread model: posix
gcc version 4.9.0 20130905 (experimental) [trunk revision 202269] (GCC) 
$ gcc-trunk -O1 -c small.c
$ gcc-4.8 -O2 -c small.c  
$ gcc-trunk -O2 -c small.c
small.c: In function ‘foo’:
small.c:5:6: internal compiler error: in check_loop_closed_ssa_use, at
tree-ssa-loop-manip.c:551
 void foo ()
      ^
0xa25746 check_loop_closed_ssa_use
    ../../gcc-trunk/gcc/tree-ssa-loop-manip.c:550
0xa2717c check_loop_closed_ssa_stmt
    ../../gcc-trunk/gcc/tree-ssa-loop-manip.c:566
0xa2717c verify_loop_closed_ssa(bool)
    ../../gcc-trunk/gcc/tree-ssa-loop-manip.c:600
0xdc61d8 tree_unroll_loops_completely(bool, bool)
    ../../gcc-trunk/gcc/tree-ssa-loop-ivcanon.c:1239
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
$ 


---------------------------------


int a, *d; 
long b;
short c;

void foo ()
{
  int e;
 lbl:
  for (c = 0; c < 2; c++)
    {
      if (1 >> b)
    break;
      e = *d;
      for (; a; a++)
        {
      *d = e;
      if (b)
        goto lbl;
        }
    }
}
>From gcc-bugs-return-429048-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Sep 05 17:20:08 2013
Return-Path: <gcc-bugs-return-429048-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 9522 invoked by alias); 5 Sep 2013 17:20:07 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 9492 invoked by uid 48); 5 Sep 2013 17:20:04 -0000
From: "dominiq at lps dot ens.fr" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/58326] [4.9 Regression] ICE in check_loop_closed_ssa_use, at tree-ssa-loop-manip.c:551
Date: Thu, 05 Sep 2013 17:20:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: unknown
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: dominiq at lps dot ens.fr
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status cf_reconfirmed_on short_desc everconfirmed
Message-ID: <bug-58326-4-NgvqH2QfU4@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-58326-4@http.gcc.gnu.org/bugzilla/>
References: <bug-58326-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2013-09/txt/msg00288.txt.bz2
Content-length: 797

http://gcc.gnu.org/bugzilla/show_bug.cgi?idX326

Dominique d'Humieres <dominiq at lps dot ens.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-09-05
            Summary|ICE in                      |[4.9 Regression] ICE in
                   |check_loop_closed_ssa_use,  |check_loop_closed_ssa_use,
                   |at                          |at
                   |tree-ssa-loop-manip.c:551   |tree-ssa-loop-manip.c:551
     Ever confirmed|0                           |1

--- Comment #1 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
The code compiles with revision 201729.

[Bug tree-optimization/58326] [4.9 Regression] ICE in check_loop_closed_ssa_use, at tree-ssa-loop-manip.c:551

[su at cs dot ucdavis.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58326

--- Comment #2 from Zhendong Su <su at cs dot ucdavis.edu> ---
For additional info, please find below a variant that fails only at -O3: 

---------------------------------

int a, b, c, d;

void foo ()
{
  int e;

 lbl:
  for (c = 0; c < 2; c++)
    {
      e = d;
      for (; a; a++)
        {
      d = e;
      if (b)
        goto lbl; 
        }
    }
}

[Bug tree-optimization/58326] [4.9 Regression] ICE in check_loop_closed_ssa_use, at tree-ssa-loop-manip.c:551

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58326

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
   Target Milestone|---                         |4.9.0

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r196770.

[Bug tree-optimization/58326] [4.9 Regression] ICE in check_loop_closed_ssa_use, at tree-ssa-loop-manip.c:551

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58326

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.

[Bug tree-optimization/58326] [4.9 Regression] ICE in check_loop_closed_ssa_use, at tree-ssa-loop-manip.c:551

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58326

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
I think the issue is latent - the bitmap with changed blocks fed to
rewrite_into_loop_closed_ssa is the blocks scanned for _uses_, but as
far as I can see unloop sets the blocks that had a non-trivial update
of their loop-father which doesn't seem to be the right set as the
interesting block is not marked.

Reverting the patch papers over the issue as then the cfgcleanup done
passes an empty bitmap to loop-closed-ssa-rewrite which fixes up the
previous mistake.

Adding verify_loop_closed_ssa into rewrite_into_loop_closed_ssa
shows the bogous IL is appearing after

          unloop_loops (loop_closed_ssa_invalidated, &irred_invalidated);

          /* We can not use TODO_update_ssa_no_phi because VOPS gets confused. 
*/
          if (loop_closed_ssa_invalidated
              && !bitmap_empty_p (loop_closed_ssa_invalidated))
            rewrite_into_loop_closed_ssa (loop_closed_ssa_invalidated,
                                          TODO_update_ssa);
          else
            update_ssa (TODO_update_ssa);

(just looked at the -O2 code for now)

[Bug tree-optimization/58326] [4.9 Regression] ICE in check_loop_closed_ssa_use, at tree-ssa-loop-manip.c:551

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58326

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Ok, so for one, fix_bb_placements for the case of moved subloop (headers):

      if (from->loop_father->header == from)
        {
          /* Subloop header, maybe move the loop upward.  */
          if (!fix_loop_placement (from->loop_father, irred_invalidated))
            continue;
          target_loop = loop_outer (from->loop_father);
        }

doesn't include the header (or any of its body BBs in this case) in the
set of loop_closed_ssa_invalidated blocks.  At least the header can
use a name defined in the previous outer loop (and I fail to see why
a random loop body block couldn't).

But then, rewrite-into-LC-ssa does

static void
find_uses_to_rename_bb (basic_block bb, bitmap *use_blocks, bitmap need_phis)
{
  gimple_stmt_iterator bsi;
  edge e;
  edge_iterator ei;

  FOR_EACH_EDGE (e, ei, bb->succs)
    for (bsi = gsi_start_phis (e->dest); !gsi_end_p (bsi); gsi_next (&bsi))
      {
        gimple phi = gsi_stmt (bsi);
        if (! virtual_operand_p (gimple_phi_result (phi)))
          find_uses_to_rename_use (bb, PHI_ARG_DEF_FROM_EDGE (phi, e),
                                   use_blocks, need_phis);
      }

so for uses in PHIs it considers all destinations of edges out of
"changed" blocks (but not uses in PHIs of the block itself).  For
some weird reason.  Well - in this case one predecessor is in the
set of changed blocks and one (the one from the backedge) isn't.

Fixing fix_bb_placements to include all blocks of moved sub-loops
in loop_closed_ssa_invalidated fixes the testcases, but still the
above looks odd.

[Bug tree-optimization/58326] [4.9 Regression] ICE in check_loop_closed_ssa_use, at tree-ssa-loop-manip.c:551

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58326

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Mon Sep  9 13:18:38 2013
New Revision: 202399

URL: http://gcc.gnu.org/viewcvs?rev=202399&root=gcc&view=rev
Log:
2013-09-09  Richard Biener  <rguenther@suse.de>

    PR middle-end/58326
    * cfgloopmanip.c (fix_bb_placements): When fixing the placement
    of a subloop record all its block as affecting loop-closed SSA form.

    * gcc.dg/torture/pr58326-1.c: New testcase.
    * gcc.dg/torture/pr58326-2.c: Likewise.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr58326-1.c
    trunk/gcc/testsuite/gcc.dg/torture/pr58326-2.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/cfgloopmanip.c
    trunk/gcc/testsuite/ChangeLog

[Bug tree-optimization/58326] [4.9 Regression] ICE in check_loop_closed_ssa_use, at tree-ssa-loop-manip.c:551

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58326

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
            Version|unknown                     |4.9.0
         Resolution|---                         |FIXED

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.