[Bug tree-optimization/58794] New: ICE in set_lattice_value, at tree-ssa-ccp.c:455 on x86_64-linux-gnu (at -O1, -O2, and -O3)

[Bug tree-optimization/58794] New: ICE in set_lattice_value, at tree-ssa-ccp.c:455 on x86_64-linux-gnu (at -O1, -O2, and -O3)

[su at cs dot ucdavis.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58794

            Bug ID: 58794
           Summary: ICE in set_lattice_value, at tree-ssa-ccp.c:455 on
                    x86_64-linux-gnu (at -O1, -O2, and -O3)
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu

The following code causes an ICE when compiled with the current gcc trunk and
gcc 4.8.2 at -O1, -O2, and -O3 on x86_64-linux in both 32-bit and 64-bit modes. 

It doesn't affect 4.8.1 and 4.7.x. 

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.9.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure
--enable-languages=c,c++,objc,obj-c++,fortran,lto --disable-werror
--enable-checking=release --with-gmp=/usr/local/gcc-trunk
--with-mpfr=/usr/local/gcc-trunk --with-mpc=/usr/local/gcc-trunk
--with-cloog=/usr/local/gcc-trunk --prefix=/usr/local/gcc-trunk
Thread model: posix
gcc version 4.9.0 20131018 (experimental) [trunk revision 203811] (GCC) 
$ 
$ gcc-trunk -O0 small.c
$
$ gcc-trunk -O1 small.c
small.c: In function ‘main’:
small.c:21:1: internal compiler error: in set_lattice_value, at
tree-ssa-ccp.c:455
 main ()
 ^
0x8dcc6a set_lattice_value
    ../../gcc-trunk/gcc/tree-ssa-ccp.c:455
0x8e1182 visit_assignment
    ../../gcc-trunk/gcc/tree-ssa-ccp.c:2017
0x94367a simulate_stmt
    ../../gcc-trunk/gcc/tree-ssa-propagate.c:314
0x9437d1 process_ssa_edge_worklist
    ../../gcc-trunk/gcc/tree-ssa-propagate.c:388
0x943bf9 ssa_propagate(ssa_prop_result (*)(gimple_statement_d*, edge_def**,
tree_node**), ssa_prop_result (*)(gimple_statement_d*))
    ../../gcc-trunk/gcc/tree-ssa-propagate.c:849
0x8df85a do_ssa_ccp
    ../../gcc-trunk/gcc/tree-ssa-ccp.c:2132
0x8df85a execute
    ../../gcc-trunk/gcc/tree-ssa-ccp.c:2175
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
$ 


------------------------------


struct S0
{
  int f;
};

struct S1
{
  struct S0 f1;
  volatile int f2;
};

struct S2
{
  struct S1 g;
} a, b; 

static int *c[1][2] = {{0, (int *)&a.g.f2}};
static int d; 

int
main ()
{
  for (d = 0; d < 1; d++)
    for (b.g.f1.f = 0; b.g.f1.f < 1; b.g.f1.f++)
      *c[b.g.f1.f][d + 1] = 0;
  return 0;
}
>From gcc-bugs-return-432153-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Oct 18 18:44:31 2013
Return-Path: <gcc-bugs-return-432153-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 18233 invoked by alias); 18 Oct 2013 18:44:31 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 18202 invoked by uid 48); 18 Oct 2013 18:44:28 -0000
From: "su at cs dot ucdavis.edu" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/58794] ICE in set_lattice_value, at tree-ssa-ccp.c:455 on x86_64-linux-gnu (at -O1, -O2, and -O3)
Date: Fri, 18 Oct 2013 18:44:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: su at cs dot ucdavis.edu
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-58794-4-8oXxS20TMM@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-58794-4@http.gcc.gnu.org/bugzilla/>
References: <bug-58794-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2013-10/txt/msg01297.txt.bz2
Content-length: 434

http://gcc.gnu.org/bugzilla/show_bug.cgi?idX794

--- Comment #1 from Zhendong Su <su at cs dot ucdavis.edu> ---
Below is a related testcase that only fails with the current trunk at -O1.

-----------------------

struct S
{
  volatile int f;
} a;

unsigned int b;

static int *c[1][2] = {{0, (int *)&a.f}};
static unsigned int d;

int
main ()
{
  for (; d < 1; d++)
    for (; b < 1; b++)
      *c[b][d + 1] = 0;

  return 0;
}

[Bug tree-optimization/58794] [4.8/4.9 Regression] ICE in set_lattice_value, at tree-ssa-ccp.c:455 on x86_64-linux-gnu (at -O1, -O2, and -O3)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58794

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2013-10-21
      Known to work|                            |4.7.3, 4.8.1
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
   Target Milestone|---                         |4.8.3
            Summary|ICE in set_lattice_value,   |[4.8/4.9 Regression] ICE in
                   |at tree-ssa-ccp.c:455 on    |set_lattice_value, at
                   |x86_64-linux-gnu (at -O1,   |tree-ssa-ccp.c:455 on
                   |-O2, and -O3)               |x86_64-linux-gnu (at -O1,
                   |                            |-O2, and -O3)
     Ever confirmed|0                           |1
      Known to fail|                            |4.8.2, 4.9.0

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.  Another ADDR_EXPR of volatile equivalence bug ...

[Bug tree-optimization/58794] [4.8/4.9 Regression] ICE in set_lattice_value, at tree-ssa-ccp.c:455 on x86_64-linux-gnu (at -O1, -O2, and -O3)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58794

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
The issue being that &a.f and &a.f are not equal because even with
OEP_CONSTANT_ADDRESS_OF set we get into

        case COMPONENT_REF:
          /* Handle operand 2 the same as for ARRAY_REF.  Operand 0
             may be NULL when we're called to compare MEM_EXPRs.  */
          if (!OP_SAME_WITH_NULL (0))
            return 0;
          flags &= ~OEP_CONSTANT_ADDRESS_OF;
          return OP_SAME (1) && OP_SAME_WITH_NULL (2);

and thus drop it before comparing the two FIELD_DECLs which have
TREE_SIDE_EFFECTS set.  Fixed with

Index: gcc/fold-const.c
===================================================================
--- gcc/fold-const.c    (revision 203886)
+++ gcc/fold-const.c    (working copy)
@@ -2715,10 +2715,11 @@ operand_equal_p (const_tree arg0, const_
        case COMPONENT_REF:
          /* Handle operand 2 the same as for ARRAY_REF.  Operand 0
             may be NULL when we're called to compare MEM_EXPRs.  */
-         if (!OP_SAME_WITH_NULL (0))
+         if (!OP_SAME_WITH_NULL (0)
+             || !OP_SAME (1))
            return 0;
          flags &= ~OEP_CONSTANT_ADDRESS_OF;
-         return OP_SAME (1) && OP_SAME_WITH_NULL (2);
+         return OP_SAME_WITH_NULL (2);

        case BIT_FIELD_REF:
          if (!OP_SAME (0))

I spotted this earlier but for some reason chickeded out to make this
change.  Hmm.  Trying to remember why ...

[Bug tree-optimization/58794] [4.8/4.9 Regression] ICE in set_lattice_value, at tree-ssa-ccp.c:455 on x86_64-linux-gnu (at -O1, -O2, and -O3)

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58794

--- Comment #5 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
> I'm sure that we can build such FIELD_DECL only with Ada though, so, Eric,
> can you provide a testcase where that happens - thus, that shows that
> side-effects cannot be ignored here by for example comparing
> &f.x and &f.x for a case where that is not equal?  I think we need to
> concern ourselves only with mutating side-effects, not a volatile load.

I don't think so, we do not rely on expressions appearing in offsets or sizes
to implement the semantics of the language, that would be too error-prone;
instead these expressions are computed once for all when the type is
elaborated.

> The question is whether the patch is ok as-is or if I have to make
> behavior dependent on is_gimple_form (ugh).  A testcase that breaks
> if not guarding it that way would be nice to have (I'll check if anything
> existing triggers).

Go ahead I'd say.

[Bug tree-optimization/58794] [4.8/4.9 Regression] ICE in set_lattice_value, at tree-ssa-ccp.c:455 on x86_64-linux-gnu (at -O1, -O2, and -O3)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58794

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Mon Oct 21 13:33:29 2013
New Revision: 203891

URL: http://gcc.gnu.org/viewcvs?rev=203891&root=gcc&view=rev
Log:
2013-10-21  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/58794
    * fold-const.c (operand_equal_p): Compare FIELD_DECL operand
    of COMPONENT_REFs with OEP_CONSTANT_ADDRESS_OF left in place.

    * c-c++-common/torture/pr58794-1.c: New testcase.
    * c-c++-common/torture/pr58794-2.c: Likewise.

Added:
    trunk/gcc/testsuite/c-c++-common/torture/pr58794-1.c
    trunk/gcc/testsuite/c-c++-common/torture/pr58794-2.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/fold-const.c
    trunk/gcc/testsuite/ChangeLog

[Bug tree-optimization/58794] [4.8 Regression] ICE in set_lattice_value, at tree-ssa-ccp.c:455 on x86_64-linux-gnu (at -O1, -O2, and -O3)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58794

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.9.0
            Summary|[4.8/4.9 Regression] ICE in |[4.8 Regression] ICE in
                   |set_lattice_value, at       |set_lattice_value, at
                   |tree-ssa-ccp.c:455 on       |tree-ssa-ccp.c:455 on
                   |x86_64-linux-gnu (at -O1,   |x86_64-linux-gnu (at -O1,
                   |-O2, and -O3)               |-O2, and -O3)
      Known to fail|4.9.0                       |

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug tree-optimization/58794] [4.8 Regression] ICE in set_lattice_value, at tree-ssa-ccp.c:455 on x86_64-linux-gnu (at -O1, -O2, and -O3)

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58794

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
      Known to work|                            |4.8.3
         Resolution|---                         |FIXED

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.