[Bug tree-optimization/58653] New: wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[Bug tree-optimization/58653] New: wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[su at cs dot ucdavis.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

            Bug ID: 58653
           Summary: wrong code (segfaults) at -O3 on x86_64-linux-gnu in
                    64-bit mode (affecting gcc 4.6 to trunk)
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu

The current gcc trunk (as well as 4.6, 4.7, and 4.8) mis-compiles the following
code on x86_64-linux at -O3 in 64-bit mode, resulting in a segfault. 


$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.9.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure
--enable-languages=c,c++,objc,obj-c++,fortran,lto --disable-werror
--enable-checking=release --with-gmp=/usr/local/gcc-trunk
--with-mpfr=/usr/local/gcc-trunk --with-mpc=/usr/local/gcc-trunk
--with-cloog=/usr/local/gcc-trunk --prefix=/usr/local/gcc-trunk
Thread model: posix
gcc version 4.9.0 20131006 (experimental) [trunk revision 203227] (GCC) 
$ 
$ gcc-trunk -m64 -O2 small.c; a.out
$ gcc-trunk -m32 -O3 small.c; a.out
$
$ gcc-trunk -m64 -O3 small.c; a.out
Segmentation fault (core dumped)
$ gcc-4.8 -m64 -O3 small.c; a.out
Segmentation fault (core dumped)
$ gcc-4.7 -m64 -O3 small.c; a.out
Segmentation fault (core dumped)
$ gcc-4.6 -m64 -O3 small.c; a.out
Segmentation fault (core dumped)
$  

---------------------------------

int a, c, e[5][2]; 
unsigned int d;

int
main ()
{
  for (d = 0; d < 2; d++)
    if (a ? 0 : e[c + 3][d] & e[c + 4][d])
      break;
  return 0;
}

[Bug tree-optimization/58653] [4.7/4.8/4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
It's the loop unswitching.

[Bug tree-optimization/58653] [4.7/4.8/4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
      Known to work|                            |4.3.4
   Target Milestone|---                         |4.7.4

[Bug tree-optimization/58653] [4.7/4.8/4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[mikpelinux at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

Mikael Pettersson <mikpelinux at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mikpelinux at gmail dot com

--- Comment #3 from Mikael Pettersson <mikpelinux at gmail dot com> ---
4.4.7 works, 4.5.4 fails, started with r148352 which moved the predcom pass
down
a bit (it was just before tree unswitching before this revision).  The code
generation difference for this test case at this revision looks completely
bonkers (huge addressing offsets are added, causing the SEGV):

--- pr58653.s-r148351   2013-10-11 16:44:28.999007628 +0200
+++ pr58653.s-r148352   2013-10-11 16:41:15.659132274 +0200
@@ -7,18 +7,18 @@
 .LFB0:
        .cfi_startproc
        movl    c(%rip), %eax
-       movl    a(%rip), %ecx
-       leal    3(%rax), %edx
+       movl    a(%rip), %edx
        addl    $4, %eax
-       testl   %ecx, %ecx
+       testl   %edx, %edx
        jne     .L2
-       movslq  %edx, %rdx
        cltq
-       movl    e(,%rdx,8), %ecx
-       testl   %ecx, e(,%rax,8)
+       movabsq $e+17179869180, %rdx
+       movl    (%rdx,%rax,8), %ecx
+       leaq    2147483647(%rax), %rdx
+       movl    e(,%rdx,8), %edx
+       testl   %edx, e(,%rax,8)
        jne     .L5
-       movl    e+4(,%rax,8), %eax
-       testl   %eax, e+4(,%rdx,8)
+       testl   %ecx, e+4(,%rax,8)
        jne     .L6
 .L2:
        movl    $2, d(%rip)

[Bug tree-optimization/58653] [4.7/4.8/4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.

[Bug tree-optimization/58653] [4.7/4.8/4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Hmm, looks like a very old patch in my dev tree fixes this (though reverting it
doesn't make it reproduce on trunk):

Index: tree-predcom.c
===================================================================
--- tree-predcom.c      (revision 204397)
+++ tree-predcom.c      (working copy)
@@ -1410,9 +1410,11 @@ ref_at_iteration (struct loop *loop, tre
        }
       else
        {
-         val = fold_build2 (MULT_EXPR, type, iv.step,
-                            build_int_cst_type (type, iter));
-         val = fold_build2 (PLUS_EXPR, type, iv.base, val);
+         tree itype = signed_type_for (type);
+         val = fold_build2 (MULT_EXPR, itype, fold_convert (itype, iv.step),
+                            build_int_cst (itype, iter));
+         val = fold_build2 (PLUS_EXPR, itype,
+                            fold_convert (itype, iv.base), val);
        }
       *idx_p = unshare_expr (val);
     }

but the above is a hack - we get

  <bb 6>:
  _27 = c.1_6 + 4;
  _24 = c.1_6 + 4;
  _23 = e[_27][-2];
  _32 = e[_24][-1];

instead of

  <bb 6>:
  _27 = c.1_6 + 4;
  _24 = c.1_6 + 4;
  _23 = e[_27][4294967294];
  _32 = e[_24][4294967295];

still this looks somewhat familiar to me ...

[Bug tree-optimization/58653] [4.7/4.8/4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
The issue is that predcom treats

  e[c + 3][d] and e[c + 4][d]

as having distance '2', but that's in a dimension that is not evolving.
Later we adjust the evolving dimension index with an adjusted value
which obviously breaks as it gets out-of-bounds.  That will later
confuse data-ref analysis as well, so the "fix" using signed arithmetic
doesn't fix the underlying issue.

I'm not sure why the issue with tree_could_trap_p exists, tree_could_trap_p
is very conservative and we can arrange for constant offsets to appear
in a single MEM_REF.

Trying a patch doing that.

[Bug tree-optimization/58653] [4.7/4.8/4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
*** Bug 58697 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/58653] [4.7/4.8/4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Wed Nov  6 15:00:16 2013
New Revision: 204458

URL: http://gcc.gnu.org/viewcvs?rev=204458&root=gcc&view=rev
Log:
2013-11-06  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/58653
    * tree-predcom.c (ref_at_iteration): Rewrite to generate
    a MEM_REF.
    (prepare_initializers_chain): Adjust.

    * gcc.dg/tree-ssa/predcom-6.c: New testcase.
    * gcc.dg/tree-ssa/predcom-7.c: Likewise.

Added:
    trunk/gcc/testsuite/gcc.dg/tree-ssa/predcom-6.c
    trunk/gcc/testsuite/gcc.dg/tree-ssa/predcom-7.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-predcom.c

[Bug tree-optimization/58653] [4.7/4.8 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.9.0
            Summary|[4.7/4.8/4.9 Regression]    |[4.7/4.8 Regression] wrong
                   |wrong code (segfaults) at   |code (segfaults) at -O3 on
                   |-O3 on x86_64-linux-gnu in  |x86_64-linux-gnu in 64-bit
                   |64-bit mode (affecting gcc  |mode (affecting gcc 4.6 to
                   |4.6 to trunk)               |trunk)
      Known to fail|                            |4.8.2

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug tree-optimization/58653] [4.7/4.8 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

Bug 58653 depends on bug 59047, which changed state.

Bug 59047 Summary: [4.9 Regression] wrong code for bitfields at -O3 on x86_64-linux-gnu
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59047

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

[Bug tree-optimization/58653] [4.7/4.8 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Mon Nov 18 15:13:14 2013
New Revision: 204965

URL: http://gcc.gnu.org/viewcvs?rev=204965&root=gcc&view=rev
Log:
2013-11-18  Richard Biener  <rguenther@suse.de>

    Backport from mainline
    2013-10-21  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/58794
    * fold-const.c (operand_equal_p): Compare FIELD_DECL operand
    of COMPONENT_REFs with OEP_CONSTANT_ADDRESS_OF left in place.

    * c-c++-common/torture/pr58794-1.c: New testcase.
    * c-c++-common/torture/pr58794-2.c: Likewise.

    2013-10-21  Richard Biener  <rguenther@suse.de>

    PR middle-end/58742
    * fold-const.c (fold_binary_loc): Fold ((T) (X /[ex] C)) * C
    to (T) X for sign-changing conversions (or no conversion).

    * c-c++-common/fold-divmul-1.c: New testcase.

    2013-11-06  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/58653
    * tree-predcom.c (ref_at_iteration): Rewrite to generate
    a MEM_REF.
    (prepare_initializers_chain): Adjust.

    * gcc.dg/tree-ssa/predcom-6.c: New testcase.
    * gcc.dg/tree-ssa/predcom-7.c: Likewise.

    PR tree-optimization/59047
    * tree-predcom.c (ref_at_iteration): Handle bitfield accesses
    properly.

    * gcc.dg/torture/pr59047.c: New testcase.

    2013-10-15  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/58143
    * tree-ssa-loop-im.c (arith_code_with_undefined_signed_overflow):
    New function.
    (rewrite_to_defined_overflow): Likewise.
    (move_computations_dom_walker::before_dom): Rewrite stmts
    with undefined signed overflow that are not always executed
    into unsigned arithmetic.

    * gcc.dg/torture/pr58143-1.c: New testcase.
    * gcc.dg/torture/pr58143-2.c: Likewise.
    * gcc.dg/torture/pr58143-3.c: Likewise.

Added:
    branches/gcc-4_8-branch/gcc/testsuite/c-c++-common/fold-divmul-1.c
    branches/gcc-4_8-branch/gcc/testsuite/c-c++-common/torture/pr58794-1.c
    branches/gcc-4_8-branch/gcc/testsuite/c-c++-common/torture/pr58794-2.c
    branches/gcc-4_8-branch/gcc/testsuite/gcc.dg/torture/pr58143-1.c
    branches/gcc-4_8-branch/gcc/testsuite/gcc.dg/torture/pr58143-2.c
    branches/gcc-4_8-branch/gcc/testsuite/gcc.dg/torture/pr58143-3.c
    branches/gcc-4_8-branch/gcc/testsuite/gcc.dg/torture/pr59047.c
    branches/gcc-4_8-branch/gcc/testsuite/gcc.dg/tree-ssa/predcom-6.c
    branches/gcc-4_8-branch/gcc/testsuite/gcc.dg/tree-ssa/predcom-7.c
Modified:
    branches/gcc-4_8-branch/gcc/ChangeLog
    branches/gcc-4_8-branch/gcc/fold-const.c
    branches/gcc-4_8-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_8-branch/gcc/tree-predcom.c
    branches/gcc-4_8-branch/gcc/tree-ssa-loop-im.c

[Bug tree-optimization/58653] [4.7 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.8.3
            Summary|[4.7/4.8 Regression] wrong  |[4.7 Regression] wrong code
                   |code (segfaults) at -O3 on  |(segfaults) at -O3 on
                   |x86_64-linux-gnu in 64-bit  |x86_64-linux-gnu in 64-bit
                   |mode (affecting gcc 4.6 to  |mode (affecting gcc 4.6 to
                   |trunk)                      |trunk)

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
And 4.8.

[Bug tree-optimization/58653] [4.7 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu in 64-bit mode (affecting gcc 4.6 to trunk)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58653

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|4.7.4                       |4.8.3
      Known to fail|                            |4.7.4

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed for 4.8.3.