[Bug c++/58380] New: ice in fold_comparison

[Bug c++/58380] New: ice in fold_comparison

[dcb314 at hotmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

            Bug ID: 58380
           Summary: ice in fold_comparison
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com

Created attachment 30785
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30785&action=edit
gzipped C++ source code

I just tried to compile package k3d-0.8.0.2-19 with gcc 4.9 trunk
dated 20130909. It said

/home/dcb/rpmbuild/BUILD/k3d-source-0.8.0.2/k3dsdk/document_plugin_factory.h:48:9:
internal compiler error: Segmentation fault
  inode* create_plugin(iplugin_factory& Factory, idocument& Document)
         ^
0xacdd4f crash_signal
    ../../src/trunk/gcc/toplev.c:335
0x8b7709 fold_comparison
    ../../src/trunk/gcc/fold-const.c:9052
0x8c0b9b fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
    ../../src/trunk/gcc/fold-const.c:12780
0xaff5d2 cleanup_control_expr_graph
    ../../src/trunk/gcc/tree-cfgcleanup.c:96
0xaff5d2 cleanup_control_flow_bb
    ../../src/trunk/gcc/tree-cfgcleanup.c:171
0xaff5d2 cleanup_tree_cfg_bb
    ../../src/trunk/gcc/tree-cfgcleanup.c:589
0xb01018 cleanup_tree_cfg_1
    ../../src/trunk/gcc/tree-cfgcleanup.c:634
0xb01018 cleanup_tree_cfg_noloop
    ../../src/trunk/gcc/tree-cfgcleanup.c:690
0xb01018 cleanup_tree_cfg()
    ../../src/trunk/gcc/tree-cfgcleanup.c:745
0xa27a84 execute_function_todo
    ../../src/trunk/gcc/passes.c:1791
0xa28167 execute_todo
    ../../src/trunk/gcc/passes.c:1866
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

Here is valgrind helping out with a stack backtrace

==23967== Invalid read of size 2
==23967==    at 0x8B7709: fold_comparison(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*) (fold-const.c:9052)
==23967==    by 0x8C0B9B: fold_binary_loc(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*) (fold-const.c:12780)
==23967==    by 0xAFF5D2: cleanup_tree_cfg_bb(basic_block_def*)
(tree-cfgcleanup.c:96)
==23967==    by 0xB01018: cleanup_tree_cfg() (tree-cfgcleanup.c:634)

Preprocessed source code attached. Flag -O2 required.

[Bug c++/58380] ice in fold_comparison

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-09-10
                 CC|                            |mpolacek at gcc dot gnu.org
      Known to work|                            |4.8.1
   Target Milestone|---                         |4.9.0
     Ever confirmed|0                           |1
      Known to fail|                            |4.9.0

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed, needs -O2.  Bisecting...

[Bug c++/58380] [4.9 Regression] ice in fold_comparison

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Seems to have started with r202296.  I'll try to reduce it.

[Bug tree-optimization/58380] [4.9 Regression] ice in fold_comparison

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

Jeffrey A. Law <law at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at redhat dot com

--- Comment #3 from Jeffrey A. Law <law at redhat dot com> ---
Just a note, I'm currently looking at a mis-compilation due to those changes;
it may not be worth your time to try and reduce this test until I've sorted out
this other issue.

[Bug tree-optimization/58380] [4.9 Regression] ice in fold_comparison

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

--- Comment #4 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Thanks, the .ii file is huge and after an ~hour of reducing the creduce is
still at original file...

[Bug tree-optimization/58380] [4.9 Regression] ice in fold_comparison

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

Markus Trippelsdorf <markus at trippelsdorf dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |markus at trippelsdorf dot de

--- Comment #5 from Markus Trippelsdorf <markus at trippelsdorf dot de> ---
Created attachment 30789
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30789&action=edit
reduced testcase

This is what creduce came up with.

[Bug tree-optimization/58380] [4.9 Regression] ice in fold_comparison

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
The symptom hints at a released SSA name being looked at.  That happens
if cfgcleanup looks at a dead code region (we especially run
TODO_cleanup_cfg before TODO_update_ssa to allow passes to be forgiving
with not removing dead blocks).  Eventually we guarded these foldings
but seem to have removed the guarding again.

[Bug tree-optimization/58380] [4.9 Regression] ice in fold_comparison

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

--- Comment #7 from Jeffrey A. Law <law at redhat dot com> ---
202296 doesn't change anything WRT sequencing of operations; it merely allows
the threader to dive a bit deeper into the CFG to determine a final target for
a jump threading opportunity.

Presumably David bootstrapped the trunk, then built k3d?  If so, then it might
be a mis-compilation of GCC itself.  As I mentioned in c#3 I'm looking at one
of those right now.

If this failure occurs in a stage1 cc1plus, then, well, that's totally
different (and much easier to track down).

Either way, it's mine.

[Bug tree-optimization/58380] [4.9 Regression] ice in fold_comparison

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

--- Comment #8 from Jeffrey A. Law <law at redhat dot com> ---
This looks like slightly different variant of 58343 where we thread through a
loop header when we really didn't want to.

I haven't tracked it through to the ICE, but from looking at the CFG and the
registered jump thread, it's obvious we're threading through a loop header.

Presumably the code to handle threading through loop headers is (again) not
prepared for this particularly shaped CFG with a thread trough the header and
in the process mucks things up pretty badly.

[Bug tree-optimization/58380] [4.9 Regression] ice in fold_comparison

[dcb314 at hotmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

--- Comment #9 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to Jeffrey A. Law from comment #7)
> Presumably David bootstrapped the trunk, then built k3d?  

Yes, the bootstrap ran fine with the usual -g -O2 on BOOT_CFLAGS.

> If this failure occurs in a stage1 cc1plus, then, well, that's totally
> different (and much easier to track down).

Yes, exactly the same Segmentation fault does occur in a stage1 cc1plus.

Command line was

$ ../results/bin/gcc -c -O2 -B/home/dcb/gcc/working/stage1-gcc/ -v bug118.cc
...
 /home/dcb/gcc/working/stage1-gcc/cc1plus -quiet ...

[Bug tree-optimization/58380] [4.9 Regression] ice in fold_comparison

[law at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

--- Comment #10 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Author: law
Date: Wed Sep 11 02:23:48 2013
New Revision: 202489

URL: http://gcc.gnu.org/viewcvs?rev=202489&root=gcc&view=rev
Log:
    PR tree-optimization/58380
    * tree-ssa-threadupdate.c (thread_block): Recognize another case
    of threading through a buried loop header.

    * tree-ssa-threadedge.c (thread_around_empty_blocks): Correct
    return value for single successor case.

    * g++.dg/torture/pr58380.C: New test.

2013-09-10  Jeff Law  <law@redhat.com>

Added:
    trunk/gcc/testsuite/g++.dg/torture/pr58380.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-threadedge.c
    trunk/gcc/tree-ssa-threadupdate.c

[Bug tree-optimization/58380] [4.9 Regression] ice in fold_comparison

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58380

--- Comment #11 from Jeffrey A. Law <law at redhat dot com> ---
Fixed on trunk.