[Bug tree-optimization/58978] New: [4.9 Regression] ICE: Segmentation fault

[Bug tree-optimization/58978] New: [4.9 Regression] ICE: Segmentation fault

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

            Bug ID: 58978
           Summary: [4.9 Regression] ICE: Segmentation fault
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: octoploid at yandex dot com

markus@x4 tmp % cat test.ii
class A {
public:
  int m_fn1();
};
class B {
public:
  static B *m_fn1(int);
  enum {
    d = 8,
    Sub,
    Mul,
    UDiv,
    SDiv,
    URem,
    SRem,
    Shl,
    LShr
  };
};
class C {
  A Lex;
  void m_fn1();
};
void C::m_fn1() {
  switch (0)
  case 0: {
    int a = Lex.m_fn1();
    switch (a) {
    case 1:
    case B::Sub:
    case B::Mul:
    case B::UDiv:
    case B::SDiv:
    case B::URem:
    case B::SRem:
    case B::Shl:
    case 0:
    case B::LShr:
      break;
    default:
      __builtin_unreachable();
    }
    B::m_fn1(a);
  }
}

markus@x4 tmp % g++ -O2 -c test.ii
test.ii: In member function ‘void C::m_fn1()’:
test.ii:24:6: internal compiler error: Segmentation fault
 void C::m_fn1() {
      ^
0xb15d0f crash_signal
        ../../gcc/gcc/toplev.c:334
0xd2a30f single_imm_use
        ../../gcc/gcc/ssa-iterators.h:426
0xd2a30f all_imm_uses_in_stmt_or_feed_cond
        ../../gcc/gcc/tree-vrp.c:6480
0xd2a30f remove_range_assertions
        ../../gcc/gcc/tree-vrp.c:6622
0xd2a30f execute_vrp
        ../../gcc/gcc/tree-vrp.c:9759
0xd2a30f execute
        ../../gcc/gcc/tree-vrp.c:9842
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
>From gcc-bugs-return-433339-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Sun Nov 03 11:35:49 2013
Return-Path: <gcc-bugs-return-433339-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 1311 invoked by alias); 3 Nov 2013 11:35:48 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 787 invoked by uid 48); 3 Nov 2013 11:33:43 -0000
From: "redi at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/58977] C++11 uniform initialization syntax causes error
Date: Sun, 03 Nov 2013 11:35:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 4.8.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: redi at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-58977-4-e52skmnbiW@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-58977-4@http.gcc.gnu.org/bugzilla/>
References: <bug-58977-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2013-11/txt/msg00116.txt.bz2
Content-length: 241

http://gcc.gnu.org/bugzilla/show_bug.cgi?idX977

--- Comment #1 from Jonathan Wakely <redi at gcc dot gnu.org> ---
I think this is
http://www.open-std.org/Jtc1/sc22/wg21/docs/cwg_defects.html#1288 which makes
this a duplicate of PR 50025

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

octoploid at yandex dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #1 from octoploid at yandex dot com ---
Started with r204255.

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-11-04
                 CC|                            |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |4.9.0
     Ever confirmed|0                           |1

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Here, single_imm_use can set the stmt to NULL:

  /* If there aren't any uses whatsoever, we're done.  */
  if (ptr == ptr->next)
    {   
    return_false:
      *use_p = NULL_USE_OPERAND_P;
      *stmt = NULL;

and then we're calling gimple_code on that NULL stmt:
  if (gimple_code (use_stmt) != GIMPLE_COND

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Thus, hopefully:
--- a/gcc/tree-vrp.c
+++ b/gcc/tree-vrp.c
@@ -6479,8 +6479,9 @@ all_imm_uses_in_stmt_or_feed_cond (tree var, gimple stmt,
basic_blo
               && single_imm_use (gimple_assign_lhs (use_stmt),
                                  &use2_p, &use_stmt))
          ;
-       if (gimple_code (use_stmt) != GIMPLE_COND
-           || gimple_bb (use_stmt) != cond_bb)
+       if (use_stmt
+           && (gimple_code (use_stmt) != GIMPLE_COND
+               || gimple_bb (use_stmt) != cond_bb))
          return false;
       }
   return true;

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Reduced testcase:
int
foo (int x)
{
  switch (x)
    {
    case 0:
    case 1:
    case 9:
      break;
    default:
      __builtin_unreachable ();
    }
  return x;
}

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |mpolacek at gcc dot gnu.org

--- Comment #5 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
On it.

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 31148
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31148&action=edit
gcc49-pr58978.patch

While your patch will work too, I think it is better to fix it differently, the
problem is that single_imm_use modifies the use_stmt argument even if it
returns false, which I didn't expect.

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #6)
> Created attachment 31148 [details]
> gcc49-pr58978.patch
> 
> While your patch will work too, I think it is better to fix it differently,
> the problem is that single_imm_use modifies the use_stmt argument even if it
> returns false, which I didn't expect.

Yeah, that looks good to me.

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

--- Comment #9 from octoploid at yandex dot com ---
With your patch applied I get this new ICE:

/home/markus/mozilla-central/js/src/jit/IonBuilder.cpp:6937:1: internal
compiler error: Segmentation fault
 IonBuilder::jsop_getelem_typed(MDefinition *obj, MDefinition *index,
 ^
0xb15d0f crash_signal
        ../../gcc/gcc/toplev.c:334
0xd2a30f single_imm_use
        ../../gcc/gcc/ssa-iterators.h:426
0xd2a30f all_imm_uses_in_stmt_or_feed_cond
        ../../gcc/gcc/tree-vrp.c:6480
0xd2a30f remove_range_assertions
        ../../gcc/gcc/tree-vrp.c:6622
0xd2a30f execute_vrp
        ../../gcc/gcc/tree-vrp.c:9759
0xd2a30f execute
        ../../gcc/gcc/tree-vrp.c:9842
Please submit a full bug report

I'm currently reducing this testcase.

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[octoploid at yandex dot com]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="UTF-8", Size: 4064 bytes --]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

--- Comment #10 from octoploid at yandex dot com ---
(In reply to octoploid from comment #9)
> With your patch applied I get this new ICE:
>
I've posted the wrong backtrace. Here's the correct one:

/var/tmp/gcc_test/usr/local/bin/g++ -w -c -std=gnu++0x  -O2  test.ii
/home/markus/mozilla-central/js/src/jit/IonBuilder.cpp: In member function
‘bool js::jit::IonBuilder::jsop_getelem_typed(js::jit::MDefinition*,
js::jit::MDefinition*, js::Sca
larTypeRepresentation::Type)’:
/home/markus/mozilla-central/js/src/jit/IonBuilder.cpp:6937:1: internal
compiler error: tree check: expected ssa_name, have component_ref in
single_imm_use, at ssa-iterators.
h:419
 IonBuilder::jsop_getelem_typed(MDefinition *obj, MDefinition *index,
 ^
0xd21764 tree_check_failed(tree_node const*, char const*, int, char const*,
...)
        ../../gcc/gcc/tree.c:9421
0xd1fc95 tree_check
        ../../gcc/gcc/tree.h:2902
0xd1fc95 single_imm_use
        ../../gcc/gcc/ssa-iterators.h:419
0xd1fc95 all_imm_uses_in_stmt_or_feed_cond
        ../../gcc/gcc/tree-vrp.c:6480
0xd1fc95 remove_range_assertions
        ../../gcc/gcc/tree-vrp.c:6622
0xd1fc95 execute_vrp
        ../../gcc/gcc/tree-vrp.c:9759
0xd1fc95 execute
        ../../gcc/gcc/tree-vrp.c:9842
Please submit a full bug report,
>From gcc-bugs-return-433467-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Nov 04 15:16:27 2013
Return-Path: <gcc-bugs-return-433467-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 23802 invoked by alias); 4 Nov 2013 15:16:24 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 22893 invoked by uid 48); 4 Nov 2013 15:14:20 -0000
From: "jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/58984] [4.8/4.9 Regression] wrong code at -Os and above on x86_64-linux-gnu in 64-bit mode
Date: Mon, 04 Nov 2013 15:16:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jakub at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: jakub at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.8.3
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status assigned_to attachments.created
Message-ID: <bug-58984-4-InlNckRqu5@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-58984-4@http.gcc.gnu.org/bugzilla/>
References: <bug-58984-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2013-11/txt/msg00244.txt.bz2
Content-length: 841

http://gcc.gnu.org/bugzilla/show_bug.cgi?idX984

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 31152
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id1152&actioníit
gcc49-pr58984.patch

Untested fix.  As the access size isn't preserved, I'm checking TYPE_SIZE
(TREE_TYPE (v->value)), I believe it should be the same, otherwise we'd have an
invalid store in the caller.  I'll try to bootstrap/regtest an instrumented
version of this to log in the cases where this punted.

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #31148|0                           |1
        is obsolete|                            |

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 31153
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31153&action=edit
gcc49-pr58978.patch

Supposedly this updated patch would fix even that?

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

--- Comment #12 from octoploid at yandex dot com ---
(In reply to Jakub Jelinek from comment #11)
> Created attachment 31153 [details]
> gcc49-pr58978.patch
> 
> Supposedly this updated patch would fix even that?

Yes. Thanks.

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Author: jakub
Date: Mon Nov  4 20:17:17 2013
New Revision: 204357

URL: http://gcc.gnu.org/viewcvs?rev=204357&root=gcc&view=rev
Log:
    PR tree-optimization/58978
    * tree-vrp.c (all_imm_uses_in_stmt_or_feed_cond): Don't modify
    use_stmt by single_imm_use directly.  Only call single_imm_use
    on SSA_NAMEs.

    * gcc.c-torture/compile/pr58978.c: New test.

Added:
    trunk/gcc/testsuite/gcc.c-torture/compile/pr58978.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-vrp.c

[Bug tree-optimization/58978] [4.9 Regression] ICE: Segmentation fault

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58978

octoploid at yandex dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #14 from octoploid at yandex dot com ---
Closing.