[Bug tree-optimization/58640] New: wrong code (segfaults) at -O3 on x86_64-linux-gnu

[Bug tree-optimization/58640] New: wrong code (segfaults) at -O3 on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

            Bug ID: 58640
           Summary: wrong code (segfaults) at -O3 on x86_64-linux-gnu
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu

The current gcc trunk mis-compiles the following code on x86_64-linux at -O3 in
both 32-bit and 64-bit modes, resulting in a segfault. 

This is a regression from 4.8.x. 


$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.9.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure
--enable-languages=c,c++,objc,obj-c++,fortran,lto --disable-werror
--enable-checking=release --with-gmp=/usr/local/gcc-trunk
--with-mpfr=/usr/local/gcc-trunk --with-mpc=/usr/local/gcc-trunk
--with-cloog=/usr/local/gcc-trunk --prefix=/usr/local/gcc-trunk
Thread model: posix
gcc version 4.9.0 20131005 (experimental) [trunk revision 203223] (GCC) 
$ 
$ gcc-trunk -O2 small.c; a.out
$ gcc-4.8 -O3 small.c; a.out
$ gcc-trunk -O3 small.c; a.out
Segmentation fault (core dumped)
$ 


-------------------------------------


int a, b, c, d = 1, e;

static signed char
foo ()
{
  int f, g = a;

  for (f = 1; f < 3; f++)
    for (; b < 1; b++)
      {
        if (d)
          for (c = 0; c < 4; c++)
            for (f = 0; f < 3; f++)
              {
                for (e = 0; e < 1; e++)
                  a = g;
                if (f)
                  break;
              }
        else if (f)
          continue;
        return 0;
      }
  return 0;
}

int
main ()
{
  foo ();
  return 0;
}

[Bug tree-optimization/58640] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[mikpelinux at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

Mikael Pettersson <mikpelinux at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org

--- Comment #1 from Mikael Pettersson <mikpelinux at gmail dot com> ---
Started with r203061.  Author CC:d.

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
   Target Milestone|---                         |4.9.0
            Summary|wrong code (segfaults) at   |[4.9 Regression] wrong code
                   |-O3 on x86_64-linux-gnu     |(segfaults) at -O3 on
                   |                            |x86_64-linux-gnu

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

Jeffrey A. Law <law at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-10-10
                 CC|                            |law at redhat dot com
     Ever confirmed|0                           |1

--- Comment #2 from Jeffrey A. Law <law at redhat dot com> ---
I'm looking at it.  Not sure if the jump threading is wrong or just exposing a
problem elsewhere.  I certainly do see the fault though.

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #3 from Jeffrey A. Law <law at redhat dot com> ---
May be related to trying to thread through 2 loop headers.  ie,we're starting
the jump thread path outside any loops.  On the jump thread path we find a loop
header, then the loop header for a nested loop.  The updating code knows how to
handle threading through a single loop header in a specific set of conditions,
but I'm pretty sure it's not prepared to handle threading through a nest of
headers.

I'm still investigating.

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #4 from Jeffrey A. Law <law at redhat dot com> ---
We're ending up with latches from two different loops going to the same
destination due to the jump thread path passing through multiple loops.  This
ultimately causes the unroller to go nuts.

This should be fairly easy to catch & avoid.  And this brings to the forefront
a question that's been slowly building in the back of my mind.

Specifically, given a jump threading path, we have the ability now to lop off
the tail of the path if threading all the way to the tail would ultimately
force cancellation of the jump thread request.  Lopping off the tail may result
in better code than totally cancelling the request.  This testcase is a good
example.

Anyway, I'll be pondering how we want to deal with that as well.

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #5 from Jeffrey A. Law <law at redhat dot com> ---
Fix going through bootstrap and regression testing.

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[law at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #6 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Author: law
Date: Fri Oct 11 20:31:25 2013
New Revision: 203463

URL: http://gcc.gnu.org/viewcvs?rev=203463&root=gcc&view=rev
Log:
    PR tree-optimization/58640
    * tree-ssa-threadupdate.c (mark_threaded_blocks): Truncate jump threading
    paths that cross over two loop entry points.

    * gcc.c-torture/execute/pr58640.c: New test.

Added:
    trunk/gcc/testsuite/gcc.c-torture/execute/pr58640.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-threadupdate.c

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

Jeffrey A. Law <law at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Jeffrey A. Law <law at redhat dot com> ---
Fixed on trunk.

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #8 from Zhendong Su <su at cs dot ucdavis.edu> ---
(In reply to Jeffrey A. Law from comment #7)
> Fixed on trunk.

Verified (also against the original). 

Thanks Jeff.

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
*** Bug 58696 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Mon Oct 14 09:17:20 2013
New Revision: 203516

URL: http://gcc.gnu.org/viewcvs?rev=203516&root=gcc&view=rev
Log:
2013-10-14  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/58640
    * gcc.c-torture/execute/pr58640-2.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.c-torture/execute/pr58640-2.c
Modified:
    trunk/gcc/testsuite/ChangeLog

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #12 from Jeffrey A. Law <law at redhat dot com> ---
Oleg, I just worked through an independent problem that I saw locally that
probably explains your SH issue as well.  I expect to have a fix in the trunk
shortly.  I'll let you know so you can test it.

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[olegendo at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #13 from Oleg Endo <olegendo at gcc dot gnu.org> ---
(In reply to Jeffrey A. Law from comment #12)
> Oleg, I just worked through an independent problem that I saw locally that
> probably explains your SH issue as well.  I expect to have a fix in the
> trunk shortly.  I'll let you know so you can test it.

Jeff, do you have any updates regarding this?  The issue is still there on
current trunk rev.

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[law at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #14 from Jeffrey A. Law <law at redhat dot com> ---
Oleg, please open a new bug for the SH problem rather than piggy-backing on
this one as they're clearly distinct issues.

[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

[olegendo at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

--- Comment #15 from Oleg Endo <olegendo at gcc dot gnu.org> ---
(In reply to Jeffrey A. Law from comment #14)
> Oleg, please open a new bug for the SH problem rather than piggy-backing on
> this one as they're clearly distinct issues.

Sure. I've created PR 59446 for this.